Custom whitelists do not match #129
-
|
Describe the bug I can't use custom excludes to reduce false positives. To Reproduce But neither of them prevents this alert: Expected behavior A clear description of what you expected to happen: No output is expected. Environment (please complete the following information):
|
Beta Was this translation helpful? Give feedback.
Replies: 3 comments
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Sorry I made a mistake, the string "whitelists:" got on the same line as the comment above it in teler.example.yaml so obviously what I did under excludes would not work. But I still cannot get IP to match. The favicon.ico excludes are working. Original log line (lighttpd, log_format is in my original report): |
Beta Was this translation helpful? Give feedback.
-
|
Hei, @anrxc. We whitelist in their respective sections & patterns DO NOT apply as a whole. This means that if you whitelist an IP (pattern) and activate Bad IP Address detection, then the whitelist is valid - if Bad IP Address matches the given IP whitelist. But if your intention is to whitelist the IP from all types of threats - it won't! What I get from your point is, you want to whitelisting the IPs from Common Web Attack threat, of course that doesn't apply - because it's not part of it. The workaroung is if you want to whitelist the detection of Common Web Attack threat - you must use a pattern for request URL/path, because we detected the Common Web Attack threat as coming from there. Since this isn't explained yet - I've updated the documentation about this configuration. |
Beta Was this translation helpful? Give feedback.
Hei, @anrxc. We whitelist in their respective sections & patterns DO NOT apply as a whole. This means that if you whitelist an IP (pattern) and activate Bad IP Address detection, then the whitelist is valid - if Bad IP Address matches the given IP whitelist. But if your intention is to whitelist the IP from all types of threats - it won't!
What I get from your point is, you want to whitelisting the IPs from Common Web Attack threat, of course that doesn't apply - because it's not part of it. The workaroung is if you want to whitelist the detection of Common Web Attack threat - you must use a pattern for request URL/path, because we detected the Common Web Attack threat as coming from there.