Proactively Create and Allow Whitelist
- Log in to the LogRhythm NDR UI.
- Point to the Settings tab, click Policy Management, and then click Whitelist.
The Whitelist page appears. To create a Proactive Whitelist, enter your data into the relevant fields.
For a plain text match, enter your plain text in the field and leave the check box unchecked.
For a regular expression match, enter your regex in the field and click the check box.
Field Description Source Source IP address of the security event Expiry Date Expiry date for this whitelist rule Source Host Source host name of the security event Source User Source user name of the security event Destination Destination IP address of the security event Destination Host Destination host name of the security event Destination User Destination user name of the security event Entry Source Entry source of the security event Entry Origin Engine that has created this security event Indicator Intel event's indicator Indicator Type Intel event's indicator type Threat Level Indicates the threat level in green, orange, etc. Exclude Internal Excludes security events which are internal to a network URL URL of the security event Event Category Event category of the security event Event Attribute Event attribute of the security event Trigger Event trigger of the security event Trigger_id Event trigger id of the security event Path The file path in case of smbfiles or IP addresses involved in transmission in case of smtp logs. Site The website involved with logs and event. Query The DNS query involved in the security event. Status Code The status code returned to the request/response for a HTTP request. Dest_port The port number of the destination machine to which the data is routed. Src_port The port number of the source machine from where the data is sent. Event_extra_attributes The extra attributes related to an event. Application Application used by the security event User Agent User agent used by the security event Protocol Protocol used by the security event Reason Reason for creating this whitelist rule
xff_ip HTTP header used to track the original IP address of a user connecting to a web server through a proxy or load balancer.
- Click Add.
The message "Whitelist Inserted Successfully" appears. - To confirm that the Whitelist is successfully added, check the whitelist list at the bottom of the page.
