You can create a white list of values that should never raise an alert when they appear as the action object of an alert. The values are compared with the Action.Object field of the alert, so a white list can hold IP addresses, user names, ports, domains or any other value that an alert rule uses as its action object. Logsign USO must be in version 6.4.53 or later for this feature. IP subnet and IP range entries require version 6.4.113 or later.
To do this, log in to Logsign USO with a user whose role has the White List permissions (Read to view the page, Set to add, edit and apply white lists, Delete to remove them) and open Settings.
Click White List under the Alerts & Incidents section.
Then click the + White List button at the top right. The Add White List window opens. Fill in the fields as shown in the image below.
The Description field is the name of the white list and must be unique. The values you enter in the Data field must match the values received in Action.Object.
Example;
1.1.1.1
logsignsupport
443
8.8.8.8
google.com
10.0.0.0/24
10.0.0.1-10.0.0.50
Note: Each new line in the Data field is treated as a new value, so you do not need to separate values with commas. Values are compared exactly as written. IP subnets in CIDR notation (10.0.0.0/24) and IP ranges (10.0.0.1-10.0.0.50) are also supported and match every IP address they cover. A white list can contain up to 1000 lines, and a subnet or range that is not written correctly is rejected when you save.
After saving the white list, you need to select which alerts it applies to.
Click the Alerts button next to the white list. In the Apply To Alerts window, move the alerts you want to the right side and click Apply.
When you open the selected alerts under Alert Rules, the description you entered for the white list appears in the White List field, as in the image below. You can also add or remove white lists for a single alert from this field.
After these steps, the selected alerts are no longer triggered when their action object matches a value in the white list.