Whitelisting o365

L3 Networker

Whitelisting o365

I want to make sure I understand the workflow on this correctly. To whitelist o365 I would perform the following:


1) Clone the o365 miners I want, prefixing them with wl


2) Edit the input for wlwhitelist and add the wlo365 miners I created.


Is there anything I'm missing here?

L7 Applicator

Re: Whitelisting o365

Hi chrisf,

let's say you are aggregating multiple C2 IPv4 feeds using an aggregator node called C2Aggregator. You want to whitelist o365 IPs to avoid blacklisting o365 by mistake. Steps:

- create a new o365 Miner and prefix the name with "wl". Like wlO365

- select the INPUT fields of C2Aggregator and add wlO365



C2Aggregator will consider IPv4 addresses/networks coming from wlO365 as whitelist and will remove the C2 indicators overlapping the o365 networks from the aggregated feed.

L3 Networker

Re: Whitelisting o365

OK to take that one step further. Say I have 25 whitelist miners and I want to add them to a single aggregator, and then any time I bring up a new aggregator I wanted to point the wlAggregator as an input. Would this work?


Ideally I could white list all internal ip ranges, then anything for services required by the business.

L7 Applicator

Re: Whitelisting o365

Never tried, but it should work.


Note: aggregators for domains and URLs currently (0.9.22) do not support pattern matching. That means you can't use *.example.com to whitelist all the indicators with domain example.com.

L3 Networker

Re: Whitelisting o365

My goal would be not to have to add 25 whitelisted miners to every single aggregator since I'd likely want to globally whitelist. Is there a better way to go about this?

L7 Applicator

Re: Whitelisting o365

Hi chirsf,

no, this is the best way to do it. Basically you should:

- create the o365 Miners *without* wl prefix

- create an aggregator *with* wl prefix

- attach your wl aggregator to your threat indicators aggregator


I would also define a static list Miner for each wl aggregator to use for manually whitelist false positives.


Something like the schema below:


Screen Shot 2016-09-27 at 11.02.04.png

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!