Whitelisting o365

[chirss]

I want to make sure I understand the workflow on this correctly. To whitelist o365 I would perform the following:

1) Clone the o365 miners I want, prefixing them with wl

2) Edit the input for wlwhitelist and add the wlo365 miners I created.

Is there anything I'm missing here?

[lmori]

Hi chrisf,

let's say you are aggregating multiple C2 IPv4 feeds using an aggregator node called C2Aggregator. You want to whitelist o365 IPs to avoid blacklisting o365 by mistake. Steps:

- create a new o365 Miner and prefix the name with "wl". Like wlO365

- select the INPUT fields of C2Aggregator and add wlO365

- COMMIT

C2Aggregator will consider IPv4 addresses/networks coming from wlO365 as whitelist and will remove the C2 indicators overlapping the o365 networks from the aggregated feed.

[chirss]

OK to take that one step further. Say I have 25 whitelist miners and I want to add them to a single aggregator, and then any time I bring up a new aggregator I wanted to point the wlAggregator as an input. Would this work?

Ideally I could white list all internal ip ranges, then anything for services required by the business.

[lmori]

Never tried, but it should work.

Note: aggregators for domains and URLs currently (0.9.22) do not support pattern matching. That means you can't use *.example.com to whitelist all the indicators with domain example.com.

[chirss]

My goal would be not to have to add 25 whitelisted miners to every single aggregator since I'd likely want to globally whitelist. Is there a better way to go about this?

[lmori · Accepted solution]

Hi chirsf,

no, this is the best way to do it. Basically you should:

- create the o365 Miners *without* wl prefix

- create an aggregator *with* wl prefix

- attach your wl aggregator to your threat indicators aggregator

I would also define a static list Miner for each wl aggregator to use for manually whitelist false positives.

Something like the schema below: