Splunk Enterprise Security

Whitelisting values for notable events

samhodgson
Path Finder

Hi All,

I've just got Enterprise Security configured and im now trying to reduce the amount of false alarms created. Im seeing a lot of low/medium urgency network notable events that I would class as normal expected network traffic. For example i've got hundreds of 'Abnormally High Number of HTTP GET Request Events' however a lot of them are for legitimate traffic.

Is possible to say do not create notable events for this event when destination = download.windowsupdate.com (or ideally a list of whitelisted URL's)?

Any help would be greatly appreciated!

Cheers

Sam

1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

I'm stealing this suggestion that @starcher made in the enterprise-security channel on Slack.

You can make a lookup with the URLs that you want to ignore from the search, then use that lookup to drop them from the correlation search. This requires modifying the correlation search (I'd recommend making a new one from scratch, and disable the default one)

So, for example, the destination field has the URLs you want dropped, leave the correlation search syntax as-is, then append the lookup at the end and dropping anything that doesn't match. Because it's a URL match, it might not be as fuzzy as you want it, but it's a start.

| lookup mywhitelist destination OUTPUTNEW destination AS isFound | where isnull(isFound)

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

I'm stealing this suggestion that @starcher made in the enterprise-security channel on Slack.

You can make a lookup with the URLs that you want to ignore from the search, then use that lookup to drop them from the correlation search. This requires modifying the correlation search (I'd recommend making a new one from scratch, and disable the default one)

So, for example, the destination field has the URLs you want dropped, leave the correlation search syntax as-is, then append the lookup at the end and dropping anything that doesn't match. Because it's a URL match, it might not be as fuzzy as you want it, but it's a start.

| lookup mywhitelist destination OUTPUTNEW destination AS isFound | where isnull(isFound)

samhodgson
Path Finder

Thanks this helps a lot 🙂

0 Karma

starcher
Influencer

part of the benefit is that if the lookup is replicated to indexers it greatly helps performance.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...