# General Whitelisting IP's or Domains

**URL:** <https://community.zeek.org/t/general-whitelisting-ips-or-domains/5541>\
**Category:** Zeek\
**Created:** [November 28, 2018, 9:54am UTC](https://community.zeek.org/t/general-whitelisting-ips-or-domains/5541 "2018-11-28T09:54:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [November 28, 2018, 9:54am UTC](https://community.zeek.org/t/general-whitelisting-ips-or-domains/5541/1 "2018-11-28T09:54:22Z")

</div>

Hi,

Is there a generic way to whitelist certain IP’s/Subets or Domains in local.bro for the whole Bro configuration as not to produce logs and or notices.

For e.g whitelist 8.8.8.8 or [google.com](http://google.com) ?

Thanks in advanced,  
Alex Kefallonitis

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [November 29, 2018, 5:29pm UTC](https://community.zeek.org/t/general-whitelisting-ips-or-domains/5541/2 "2018-11-29T17:29:46Z")

</div>

> Is there a generic way to whitelist certain IP's/Subets or Domains in local.bro for the whole Bro configuration as not to produce logs and or notices.
> 
> For e.g whitelist 8.8.8.8 or google.com ?

It depends.. if you wanted to ignore ALL traffic to 8.8.8.8 you could add this:

&nbsp;&nbsp;&nbsp;&nbsp;redef restrict\_filters += [["not-google-dns"] = "not (host 8.8.8.8)" ];

Ignoring a 'google.com' is possible as well, but a little more involved since it  
could appear in dns, ssl, or http logs. Is there a particular kind of log that  
you are seeing domains in that you want to ignore, or all of the above?

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [November 29, 2018, 5:34pm UTC](https://community.zeek.org/t/general-whitelisting-ips-or-domains/5541/3 "2018-11-29T17:34:45Z")

</div>

Hi and thanks for the response

I want to be able to apply the whitelist in all of the above as generic solution when something is spamming or hits as false positive. So is there any generic solution ?

Thanks in advanced,  
Alex Kefallonitis

Στις Πέμ, 29 Νοε 2018 στις 7:30 μ.μ., ο/η Azoff, Justin S \<[jazoff@illinois.edu](mailto:jazoff@illinois.edu)\> έγραψε:

---

<div class="post-metadata">

**Author:** ![Alex\_Kefallonitis](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@Alex\_Kefallonitis](https://community.zeek.org/u/Alex_Kefallonitis)\
**Post date:** [December 17, 2018, 1:04pm UTC](https://community.zeek.org/t/general-whitelisting-ips-or-domains/5541/4 "2018-12-17T13:04:55Z")

</div>

So i cannot find any other way for generic whitelisting i am not so sure how dns could work. Any suggestions ?

Στις Πέμ, 29 Νοε 2018 στις 7:34 μ.μ., ο/η Alex Kefallonitis \<[al.kefallonitis@gmail.com](mailto:al.kefallonitis@gmail.com)\> έγραψε:

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/general-whitelisting-ips-or-domains/5541/5 "2022-05-06T15:46:13Z")

</div>