topic Re: Whitelisting o365 in General Topics

Whitelisting o365

chirss — Mon, 26 Sep 2016 19:22:57 GMT

I want to make sure I understand the workflow on this correctly. To whitelist o365 I would perform the following:

1) Clone the o365 miners I want, prefixing them with wl

2) Edit the input for wlwhitelist and add the wlo365 miners I created.

Is there anything I'm missing here?

Re: Whitelisting o365

lmori — Mon, 26 Sep 2016 20:15:01 GMT

Hi chrisf,

let's say you are aggregating multiple C2 IPv4 feeds using an aggregator node called C2Aggregator. You want to whitelist o365 IPs to avoid blacklisting o365 by mistake. Steps:

- create a new o365 Miner and prefix the name with "wl". Like wlO365

- select the INPUT fields of C2Aggregator and add wlO365

- COMMIT

C2Aggregator will consider IPv4 addresses/networks coming from wlO365 as whitelist and will remove the C2 indicators overlapping the o365 networks from the aggregated feed.

Re: Whitelisting o365

chirss — Mon, 26 Sep 2016 20:23:22 GMT

OK to take that one step further. Say I have 25 whitelist miners and I want to add them to a single aggregator, and then any time I bring up a new aggregator I wanted to point the wlAggregator as an input. Would this work?

Ideally I could white list all internal ip ranges, then anything for services required by the business.

Re: Whitelisting o365

lmori — Mon, 26 Sep 2016 20:30:41 GMT

Never tried, but it should work.

Note: aggregators for domains and URLs currently (0.9.22) do not support pattern matching. That means you can't use *.example.com to whitelist all the indicators with domain example.com.

Re: Whitelisting o365

chirss — Mon, 26 Sep 2016 22:16:33 GMT

My goal would be not to have to add 25 whitelisted miners to every single aggregator since I'd likely want to globally whitelist. Is there a better way to go about this?

Re: Whitelisting o365

lmori — Tue, 27 Sep 2016 09:03:00 GMT

Hi chirsf,

no, this is the best way to do it. Basically you should:

- create the o365 Miners *without* wl prefix

- create an aggregator *with* wl prefix

- attach your wl aggregator to your threat indicators aggregator

I would also define a static list Miner for each wl aggregator to use for manually whitelist false positives.

Something like the schema below: