Splunk Enterprise Security

lookup in suppression search

gcusello
SplunkTrust
SplunkTrust

Hi at all,

In Enterprise Security, I'm trying to customize a Suppression Rule inserting a lookup containing the ip addresses to whitelist in one Correlation Search, using this search:

 

 

`get_notable_index` source="Network - Vulnerability Scanner Detection (by targets) - Rule" [ | inputlookup suppression_ip.csv | fields src ]

 

 

and I have the following error message:

 

 

Error saving suppression. Error parsing search.

 

 

I also tryed to replace the subsearch using a macro, but with the same result.

Does anywone know if there's a limitation in Suppression Rules searches (as e.g. eventtypes) or what else?

Ciao.

Giuseppe

Labels (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

View solution in original post

gcusello
SplunkTrust
SplunkTrust

 at all,

suppression is an eventtype so has the limits of eventtypes and my question hasn't an answer.

Does anyone know a workaround?

Ciao.

Giuseppe

0 Karma

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...