- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I am running some Nessus scanners - these systems have not yet been integrated with Splunk.
Splunk's Enterprise Security application is listing these systems as high scanning activity devices under the network dashboards:
http://docs.splunk.com/Documentation/ES/3.3.1/User/NetworkProtectionDomaindashboards#Troubleshooting...
Obviously, I don't want Splunk to alert on high scanning activity from the Nessus systems as we expect them to scan. I am more concerned about systems that are performing scanning activity that are not my Nessus systems showing up in this list.
What is the best way to accomplish this? How would I whitelist the Nessus systems? Is a lookup best, or should I use the CIM and the data models?
I see two potential options for displaying these: 1) display only the unknown scanning systems or 2) colour the Nessus scanning systems as a green bar, and the unknown as red.
What is the best way to go about solving this problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Well damn that was easy.
I must have used the wrong Google-Fu because I could not find that part of the docs!
