Splunk Enterprise Security

How to omit Scanners as a "Threat" from the Splunk App for Enterprise Security?

gwalford
Path Finder

I am running some Nessus scanners - these systems have not yet been integrated with Splunk.

Splunk's Enterprise Security application is listing these systems as high scanning activity devices under the network dashboards:
http://docs.splunk.com/Documentation/ES/3.3.1/User/NetworkProtectionDomaindashboards#Troubleshooting...

Obviously, I don't want Splunk to alert on high scanning activity from the Nessus systems as we expect them to scan. I am more concerned about systems that are performing scanning activity that are not my Nessus systems showing up in this list.

What is the best way to accomplish this? How would I whitelist the Nessus systems? Is a lookup best, or should I use the CIM and the data models?

I see two potential options for displaying these: 1) display only the unknown scanning systems or 2) colour the Nessus scanning systems as a green bar, and the unknown as red.

What is the best way to go about solving this problem?

0 Karma
1 Solution

gwalford
Path Finder

Well damn that was easy.

I must have used the wrong Google-Fu because I could not find that part of the docs!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!