Splunk Enterprise Security

Splunk Web datamodel whitelisting

burakatabay
Path Finder

Hello Splunkers,

Trying to fix the Web data models in the CIM and would like to exclude a couple of IP addresses. However, I'm struggling to form a white list for those specific IP addresses.

I'm looking for any guidance links and resources towards creating whitelists, all help is appreciated.
Thanks, and Happy Splunking!

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Do you want to exclude IP's getting into datamodel? I would suggest to have IPs (e.g. src_ip) in the datamodel and have a category, say (web_blacklist_ips) in your asset data for those IPs. You can then create searches to exclude those Ips using the category.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!