# whitelisting

**URL:** <https://community.zeek.org/t/whitelisting/2663>\
**Category:** Zeek\
**Created:** [April 29, 2013, 10:33am UTC](https://community.zeek.org/t/whitelisting/2663 "2013-04-29T10:33:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tracy\_Reed](https://avatars.discourse-cdn.com/v4/letter/t/b5a626/32.png) [@Tracy\_Reed](https://community.zeek.org/u/Tracy_Reed)\
**Post date:** [April 29, 2013, 10:33am UTC](https://community.zeek.org/t/whitelisting/2663/1 "2013-04-29T10:33:07Z")

</div>

Hello all,

I am running Bro 2.1 in Security Onion 12.04 and I am very happy with it. This  
level of detail into what is happening on the network is just amazing! I'm  
beginning to wonder how I ever did without it for so long.

I have an ssh that happens every 5 minutes which causes a lot of noise.

I've gone through all of the docs on [bro.org](http://bro.org) and done some googling but can't  
seem to figure out how to whitelist certain connections so they will not  
constantly appear in the bro alarm summaries. I did find this, which contains  
an example for watching ssh to particular hosts which seems related to what I  
am trying to do:

[http://www.bro.org/sphinx/quickstart.html#deployment-customization](http://www.bro.org/sphinx/quickstart.html#deployment-customization)

But what I want is somewhat the opposite: I want to ignore/whitelist  
connections to certain hosts, preferably from certain IP addresses.

Can anyone suggest how this would be done?

And while I'm writing (and related to another example in the above URL) I get  
alarms about SSL certs. I would like to add our in-house CA to the list of  
accepted certs. How can I do this?

Thanks for a great tool!

---

<div class="post-metadata">

**Author:** ![lysemose](https://avatars.discourse-cdn.com/v4/letter/l/d6d6ee/32.png) [@lysemose](https://community.zeek.org/u/lysemose)\
**Post date:** [April 29, 2013, 10:45am UTC](https://community.zeek.org/t/whitelisting/2663/2 "2013-04-29T10:45:06Z")

</div>

Hi Tracy

Have you looked at this, [http://code.google.com/p/security-onion/wiki/BPF](http://code.google.com/p/security-onion/wiki/BPF)

/Lysemose

---

<div class="post-metadata">

**Author:** ![Castle\_Shane](https://avatars.discourse-cdn.com/v4/letter/c/3ab097/32.png) [@Castle\_Shane](https://community.zeek.org/u/Castle_Shane)\
**Post date:** [April 29, 2013, 2:46pm UTC](https://community.zeek.org/t/whitelisting/2663/3 "2013-04-29T14:46:38Z")

</div>

Also, the Bro scripting language is very accessible once you learn its syntax. Check out a great repository at [https://github.com/bro/](https://github.com/bro/) - especially see the "cheat sheet" link there. With this you can roll you own mods without too much trouble. Jump in!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/whitelisting/2663/4 "2022-05-06T15:40:57Z")

</div>