Splunk Enterprise Security

lookup in suppression search

gcusello
Esteemed Legend

Hi at all,

In Enterprise Security, I'm trying to customize a Suppression Rule inserting a lookup containing the ip addresses to whitelist in one Correlation Search, using this search:

 

 

`get_notable_index` source="Network - Vulnerability Scanner Detection (by targets) - Rule" [ | inputlookup suppression_ip.csv | fields src ]

 

 

and I have the following error message:

 

 

Error saving suppression. Error parsing search.

 

 

I also tryed to replace the subsearch using a macro, but with the same result.

Does anywone know if there's a limitation in Suppression Rules searches (as e.g. eventtypes) or what else?

Ciao.

Giuseppe

Labels (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

View solution in original post

gcusello
Esteemed Legend

 at all,

suppression is an eventtype so has the limits of eventtypes and my question hasn't an answer.

Does anyone know a workaround?

Ciao.

Giuseppe

0 Karma

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...