Splunk Enterprise Security

How to prevent notable events from being created in Enterprise Security when the source is one of the scanning devices?

waynemurraysgs
Engager

We have several devices that perform endpoint and network device scanning.  As intended, they are scanning prohibited ports to verify they are not open, however the ESCU correlation searches , specifically the "Prohibited network Traffic Allowed" rule, is detecting thousands of these events each day.

How can I prevent notable events from being created in Enterprise Security when the source is one of the scanning devices?

Thank you.

Tags (1)
0 Karma
1 Solution

Azeemering
Builder

Modify the correlation search to exclude the legitimate devices.

View solution in original post

starcher
Influencer

This is why you should put devices into the Assets framework and label their category "known_scanner" then you can do like NOT src_category="known_scanner" into your search. So as you update assets new scanners don't trigger correlation searches.

0 Karma

Azeemering
Builder

Modify the correlation search to exclude the legitimate devices.

dokaas_2
Communicator

Correlation rules from sources such as ESCU will have a filter macro.  For example, the rule "ESCU - Access LSASS Memory for Dump Creation - Rule" has a macro named "access_lsass_memory_for_dump_creation_filter".  You should modify the macro rather than the rule itself. 

Sometimes rules are updated in the ESCU.  If one modifies the rule directly, the search will be saved in the 'local' folder and have precedence over an updated rule in the default folder.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...