Forum Discussion
Whitelist scanner IP address
We have a regular vulnerability scan against the workstations and it keeps triggering incidents as it trying to login with known, easy to guess, passwords. Is there a way to whitelist connections from a private IP so we don't MDATP alerts during scans?
2 Replies
- Have a try of this article
https://techcommunity.microsoft.com/t5/azure-sentinel/implementing-lookups-in-azure-sentinel/ba-p/1091306
i was looking for a kind of ActiveList to exclude our scanners too and it works great. I should also mention that this scan triggers an "Internal brute-force attack" incident that doesn't have an IOC attached to it so it is not possible to create a suppression rule. Since this is an internal IP, I cannot add it to the list of custom IOCs either (though not sure how would that help if the incident doesn't include it as an IOC).
The best I can do is to suppress this type of alert completely but that would leave the computers open to real internal brute-force attacks.
