lookup in suppression search

[gcusello]

Hi at all,

In Enterprise Security, I'm trying to customize a Suppression Rule inserting a lookup containing the ip addresses to whitelist in one Correlation Search, using this search:

`get_notable_index` source="Network - Vulnerability Scanner Detection (by targets) - Rule" [ | inputlookup suppression_ip.csv | fields src ]

and I have the following error message:

Error saving suppression. Error parsing search.

I also tryed to replace the subsearch using a macro, but with the same result.

Does anywone know if there's a limitation in Suppression Rules searches (as e.g. eventtypes) or what else?

Ciao.

Giuseppe

[gcusello]

 at all,

suppression is an eventtype so has the limits of eventtypes and my question hasn't an answer.

Does anyone know a workaround?

Ciao.

Giuseppe

[starcher · Accepted solution]

You are correct suppressions are only event types. They are intended for short time window filtering.

You could use the Asset system to place the known_scanner category on the src and use the src_category field. Ideally however perm filtering should be done inside the correlation search itself. Suppressions are meant to be short term time windows.  Too many slows down performance.