Detections / Tuning , Surpress vulnerability scanner IP from ALL

[jpancrazio]

Hello All ,

First Off, SO Team -- Thank you for the hard work and the addition of the detections module .. Loving it ..

Hope this hadn't been answered before as I did look some and didn't see it , in my environment I have a vulnerability scanner that as imagined lights up the alerts really well :) , If there a way to GLOBALLY suppress alerts from that single IP?

[zfcarsonb]

I was able to successfully block spam alerts from vulnerability scanners by adding a BPF rule for Suricata.

Go to:
Administration -> Configuration -> BPF -> Suricata

Add a line like this

(not host 1.2.3.4)

where 1.2.3.4 is the IP address of your vulnerability scanner.

If you have multiple scanners, then add a line like this instead:

(not (host 1.2.3.4 or host 5.6.7.8 or host 7.6.5.4))

where each IP address is one of your scanners.

[zfcarsonb]

Edit: Fixed syntax of BPF rule.

[jpancrazio]

Incredible , thanks will try

[dougburks]

You can read more about BPF in our documentation:
https://docs.securityonion.net/en/2.4/bpf.html