Splunk Enterprise Security

Whitelisting values for notable events

samhodgson
Path Finder

Hi All,

I've just got Enterprise Security configured and im now trying to reduce the amount of false alarms created. Im seeing a lot of low/medium urgency network notable events that I would class as normal expected network traffic. For example i've got hundreds of 'Abnormally High Number of HTTP GET Request Events' however a lot of them are for legitimate traffic.

Is possible to say do not create notable events for this event when destination = download.windowsupdate.com (or ideally a list of whitelisted URL's)?

Any help would be greatly appreciated!

Cheers

Sam

1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

I'm stealing this suggestion that @starcher made in the enterprise-security channel on Slack.

You can make a lookup with the URLs that you want to ignore from the search, then use that lookup to drop them from the correlation search. This requires modifying the correlation search (I'd recommend making a new one from scratch, and disable the default one)

So, for example, the destination field has the URLs you want dropped, leave the correlation search syntax as-is, then append the lookup at the end and dropping anything that doesn't match. Because it's a URL match, it might not be as fuzzy as you want it, but it's a start.

| lookup mywhitelist destination OUTPUTNEW destination AS isFound | where isnull(isFound)

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

I'm stealing this suggestion that @starcher made in the enterprise-security channel on Slack.

You can make a lookup with the URLs that you want to ignore from the search, then use that lookup to drop them from the correlation search. This requires modifying the correlation search (I'd recommend making a new one from scratch, and disable the default one)

So, for example, the destination field has the URLs you want dropped, leave the correlation search syntax as-is, then append the lookup at the end and dropping anything that doesn't match. Because it's a URL match, it might not be as fuzzy as you want it, but it's a start.

| lookup mywhitelist destination OUTPUTNEW destination AS isFound | where isnull(isFound)

samhodgson
Path Finder

Thanks this helps a lot 🙂

0 Karma

starcher
SplunkTrust
SplunkTrust

part of the benefit is that if the lookup is replicated to indexers it greatly helps performance.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...