IDH-Alarms - exempt IP-addresses of vulnerability scanners from generating false positives

[ejgh-oe]

Hi,
Our vulnerability scanners are generating a lot of false positives when hitting our internal honeypots (SO IDH-Nodes).
What's the best way to prevent these alarms from being generated in the first place?

I was thinking about a BPF, but where should I put the BPF? BPF for PCAP, BPF for Zeek or BPF for Suricata?
IDH-alarms come from playbook, but in the end it boils down to there the packets come from.

Thanks much in advance for any clue.

[InfosecGoon]

Sorry, just to be clear -- the alerts are being generated by Playbook (your vulnerability scanners interacting with the honeypot services) or by Suricata (the traffic from your scanners to the honeypot node)?

[ejgh-oe]

The IDH alerts are generated by playbook - e.g.

and in detail view

The corresponding playbook definition (Play #2134) reads

As pointed out in my original question I'd like to suppress these alerts for certain source-IP (vulnerability-scanners) while leaving it intact (i.a. alarming) for all others.

[izidood]

just some additional info, you can make an ip ignore list in idh advanced tap. then only the idh's will ignore the scanners.

[ejgh-oe]

just some additional info, you can make an ip ignore list in idh advanced tap. then only the idh's will ignore the scanners.

The corresponding dialog box only says "it's YAML" and "be careful" ;-)

Any ideas about the syntax? I haven't found anything in the docs, i.e. https://docs.securityonion.net/en/2.4/idh.html#configuration.

[izidood]

so i havn't tested it myself, i will in a bit.
i just put in the ignore list in the default.yaml file for IDH, which is fine, but i think if you upgrade node it wont save it.
im thinking it might have to look like this perhaps ?

idh:
  opencanary:
    config:
      ip.ignorelist: [x.x.x.x.x] 

i'll test it out myself as well at some point.

[jaypfe]

@GitGoodGod

Your solution is tested functional for me!

Not OP but thanks for the input on this thread, really saved me some headache.

[izidood]

awesome m8, seems like it also worked for me.

[ejgh-oe]

Thanks @GitGoodGod - definitely helps getting out those false alarms triggered by vulnerability scans :-)

[izidood]

great!