Splunk Enterprise Security

lookup in suppression search

gcusello
Esteemed Legend

Hi at all,

In Enterprise Security, I'm trying to customize a Suppression Rule inserting a lookup containing the ip addresses to whitelist in one Correlation Search, using this search:

 

 

`get_notable_index` source="Network - Vulnerability Scanner Detection (by targets) - Rule" [ | inputlookup suppression_ip.csv | fields src ]

 

 

and I have the following error message:

 

 

Error saving suppression. Error parsing search.

 

 

I also tryed to replace the subsearch using a macro, but with the same result.

Does anywone know if there's a limitation in Suppression Rules searches (as e.g. eventtypes) or what else?

Ciao.

Giuseppe

Labels (1)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

View solution in original post

gcusello
Esteemed Legend

 at all,

suppression is an eventtype so has the limits of eventtypes and my question hasn't an answer.

Does anyone know a workaround?

Ciao.

Giuseppe

0 Karma

starcher
SplunkTrust
SplunkTrust

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...