Tuning not seeing to iqnore hosts

[jpancrazio]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

32

Storage for /

174 G

Storage for /nsm

2.0 T

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have search for this and unfortunately don't see this as an issue . I have gotten to this version from installing SO 2.0 originally and am up to current version .

When entering a tune for an alert which is expected ( our backup software and vulnerability scanner ) and and have entered and BPF exclusion under PCAP, Surricata and Zeek with the SAME exclusions ( verified the BPF statement with CoPilot to make sure it was right , or hope it is ) , But it still reports alerts and collects data for the exuded hosts, Suggestions would be greatly appreciated.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

Are you able to share the full BPF?

[jpancrazio]

I can give an obfuscated example ; not host 1.1.1.1/32 && not hot 2.2.2.2/32 && 3.3.3.3/32 I have about 5 separate IPs in the same format

[jpancrazio]

Just reviewing , HOT is a typo HERE , should be host and is correct in my BPF

[dougburks]

OK, so are you saying that it looks like this?

not host 1.1.1.1/32 && not host 2.2.2.2/32 && 3.3.3.3/32

If so, that last IP address is missing a not host. Or is that a typo here as well?

If all of the IP addresses in your BPF are single IP addresses and not ranges, then you should be able to remove the /32 from each like this:

not host 1.1.1.1 && not host 2.2.2.2 && not host 3.3.3.3

Also note that some folks find it easier to use and rather than && so you could do this:

not host 1.1.1.1 and not host 2.2.2.2 and not host 3.3.3.3

and this matches our recommendations in the BPF documentation:
https://docs.securityonion.net/en/2.4/bpf.html#multiple-conditions

If you continue to have problems, I would suggest simplifying it down to one IP address and get that working before adding other IP addresses to the BPF config.

[jpancrazio]

Thank you Doug, I will try those suggestions . I had originally tried without the CIDR on the end and didnt seem to do what i was expecting so had tried that.