Excluding Known Vulnerability Scanners
A vulnerability scanner works by probing many hosts and ports, which looks like the reconnaissance an attacker performs. If you run a scanner that you trust, add it to SenseOn so that its authorised scanning is not raised as a scanning detection.
Adding a scanner
Go to Settings > Detections. There are three settings, and you can add a scanner to any of them:
| Setting | Use it when |
|---|---|
| Exclude IP addresses from scanning detections | You know the IP address the scanner scans from. |
| Exclude host names from scanning detections | You know the host name of the machine the scanner runs on. |
| Exclude subnets from scanning detections | You know the subnet the scanner scans from, for example a pool of scanning appliances. |
Each setting holds up to 100 entries.
You need the Admin role to change these settings.
- Open Settings > Detections.
- Choose the setting that matches how you identify the scanner, by IP address, host name or subnet.
- Add the scanner's IP address, host name or subnet.
If you identify the scanner more than one way, for example a host with a fixed IP address, you can add it to more than one setting.
Only add scanners you run and trust. A host listed in these settings is not flagged for scanning activity. If that host were ever compromised, its scanning would not raise a detection. Keep the lists limited to scanners you operate, and remove an entry when the scanner is retired.
Related
- Penetration tests and red team exercises are different from routine scanning. Tell SenseOn about them in advance, as described in Red-Team / Pentesting Guidance.
- Data Connectors can ingest results from vulnerability management tools such as Qualys, Rapid7 InsightVM and Tenable.