Splunk Enterprise Security

lookup in suppression search

gcusello
SplunkTrust
SplunkTrust

Hi at all,

In Enterprise Security, I'm trying to customize a Suppression Rule inserting a lookup containing the ip addresses to whitelist in one Correlation Search, using this search:

 

 

`get_notable_index` source="Network - Vulnerability Scanner Detection (by targets) - Rule" [ | inputlookup suppression_ip.csv | fields src ]

 

 

and I have the following error message:

 

 

Error saving suppression. Error parsing search.

 

 

I also tryed to replace the subsearch using a macro, but with the same result.

Does anywone know if there's a limitation in Suppression Rules searches (as e.g. eventtypes) or what else?

Ciao.

Giuseppe

Labels (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

 at all,

suppression is an eventtype so has the limits of eventtypes and my question hasn't an answer.

Does anyone know a workaround?

Ciao.

Giuseppe

0 Karma

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...