My systems team has asked I create an exception so their new collector doesn't create alerts when hitting the honeypots I have. (I have a few )
I'd rather not, Id rather they not scan my honeypots.
What are your thoughts and reasons for them, and suggestions or how you handle similar?
thanks,
Randy
Hi Randy,
if it is feasible for the systems team to exclude the Honeypots from its actions (scanning/probing) that would make the most sense.
However if it is not possible/practical for them to exclude the Honeypots, crafting an exception rule for the source ip of the machine against the Migrated Honeypot rule (you can’t build exceptions for the legacy UBA rule) wouldn’t be too difficult
David