Hello All, Nessus keeps throwing the error that "/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json" exposes critical information for unauthenticated scans, but it the test is stupid and runs an authenticated scan, therefore it fails since the data will be presented if authenticated. We need a clean Nessus scan result and I managed to make the following changes to restmap.conf [admin:server-info] requireAuthentication = true acceptFrom = "127.0.0.1" [admin:server-info-alias] requireAuthentication = true acceptFrom = "127.0.0.1" This basically makes it even if you are authenticated you will get forbidden if you visit "/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json". This works great, but a side effect is that I am unable to view some UI pages like for example the user page anymore. I would have to remove the 127.0.0.1 line to view the UI elements. Anyone know how I can specially block "/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json" but not cause other pages like users from being blocked? This is to just get the nessus scan to pass.
... View more