Whitelists are special parsers that allow you to "discard" events, and can exist at two different steps :
Parser whitelists : Allows you to discard an event at parse time, so that it never hits the buckets.
PostOverflow whitelists : Those are whitelists that are checked after the overflow happens. It is usually best for whitelisting process that can be expensive (such as performing reverse DNS on an IP address, or performing a
whoisof an IP address).
Postoverflow whitelist folders do not exist by default so you MUST manually create them
The whitelist can be based on several criteria:
- specific IP address : if the event/overflow IP is the same, event is whitelisted
- IP ranges : if the event/overflow IP address belongs to this range, event is whitelisted
- a list of expr expressions : if any expression returns true, event is whitelisted
While the whitelists are the same for parser or postoverflows, beware that field names might change.
Source ip is usually in
evt.Meta.source_ip when it's a log, but
evt.Overflow.Alert.Source.IP when it's an overflow