How to reduce False Positives

Graylog Central (peer support)
1

Hi,

I am new to Graylog and find it to be an amazing tool. We have deployed Suricata signatures on our firewall which is sending logs to Graylog. We have configured Alerts in such a way that anything that is Level 1, 2, 3 in Suricata will be triggered. My question is how do i reduce the False Positives usign the Alerts feature in Graylog? Can i specify IP addresses so that a signature for that particular IP address will not be triggered?
Thanks in advance for your help.

2

I’m also a novice but a couple of suggestions.

  1. Depending on how many addresses, could one or more of “AND NOT” expressions be a solution in your event rule?

    ie find firewall rule with tracker ID 1483595106 and not containing your subnet 192.168.16.0/24

    1483595106 AND NOT 192.168.16.*

  2. I haven’t used them myself but I think a lookup table would also work. I don’t think you can use lookups in Events but you can in extractors so maybe you could set an “exclusion” field to 1 if the IP address from your firewall is in a lookup list and use “AND NOT” logic on that field in your Alert.

Anyway I’m sure there are better ways but that’s my suggestion.

3

Thanks for the response

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.