Splunk Enterprise Security

How to omit Scanners as a "Threat" from the Splunk App for Enterprise Security?

gwalford
Path Finder

I am running some Nessus scanners - these systems have not yet been integrated with Splunk.

Splunk's Enterprise Security application is listing these systems as high scanning activity devices under the network dashboards:
http://docs.splunk.com/Documentation/ES/3.3.1/User/NetworkProtectionDomaindashboards#Troubleshooting...

Obviously, I don't want Splunk to alert on high scanning activity from the Nessus systems as we expect them to scan. I am more concerned about systems that are performing scanning activity that are not my Nessus systems showing up in this list.

What is the best way to accomplish this? How would I whitelist the Nessus systems? Is a lookup best, or should I use the CIM and the data models?

I see two potential options for displaying these: 1) display only the unknown scanning systems or 2) colour the Nessus scanning systems as a green bar, and the unknown as red.

What is the best way to go about solving this problem?

0 Karma
1 Solution

gwalford
Path Finder

Well damn that was easy.

I must have used the wrong Google-Fu because I could not find that part of the docs!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!