Whitelist doesn't appear to be working about maltrail HOT 12 CLOSED

Have you restarted sensor after changing configuration file? If yes, then it is a bug. Can you please send details of the problematic threat (e.g. screenshot of row with problematic threat/IP)

from maltrail.

Yes....restarted a few times...did a git pull this morning as well. I do see whitelisting working in different environments (home), so I wonder if this might be the Cisco VLAN thing again. In any case here's the screenshot...thank you!

from maltrail.

Can't see from picture was the threat heuristic or something else?

from maltrail.

Threat type was IP...thank you :)

from maltrail.

@DigiAngel please update and retry

from maltrail.

Done :) Will monitor...nice thicker sparklines and love the malicious ASN icon...nicely done.

from maltrail.

:)

from maltrail.

Hrmm...these appear to still be showing up:

"2015-12-21 23:16:44.100681" ids x.x.x.31 42904 72.21.81.200 443 TCP IP 72.21.81.200 "malware distribution (suspicious)" "malc0de.com (+binarydefense.com)"
"2015-12-21 23:16:44.100826" ids x.x.x.31 59385 72.21.81.200 443 TCP IP 72.21.81.200 "malware distribution (suspicious)" "malc0de.com (+binarydefense.com)"
"2015-12-21 23:16:51.278247" ids x.x.x.31 33248 72.21.81.200 443 TCP IP 72.21.81.200 "malware distribution (suspicious)" "malc0de.com (+binarydefense.com)"

Some session and tls info for the last hit (src port 33248):

2015-12-21T23:16:51+0000        CHqXOQ3U2J26Bj6Tr7      x.x.x.31  33248   72.21.81.200    443     tcp     ssl     82.728257       970     7997    SF      T       F       0       ShADadFf        11      1418    11      8445    (empty)

2015-12-21T23:16:51+0000        CHqXOQ3U2J26Bj6Tr7      x.x.x.31  33248   72.21.81.200    443     TLSv12  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   secp256r1       iecvlist.microsoft.com  F       -       -       T       FzVFNs27QByTM9jJ94,F8HspA2KYNfDeuJDw1,FHAjW824xAVxerkd0b        (empty) CN=*.vo.msecnd.net      CN=Microsoft IT SSL SHA2,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US -       -       16773   16789   17      T

Thank you.

from maltrail.

Strange, can't reproduce with the latest revision.

Can you please send me a PCAP (with related traffic) and corresponding USER_WHITELIST?

from maltrail.

Can do...capturing now.

from maltrail.

Ah dang....I had 71.21.81.200 in the whitelist, and the IP that's showing up is 72.21.81.200....my fault on this one...sorry...now correct in my whitelist...monitoring now...I'm an idiot 8-|

from maltrail.

Confirming this is working great now..thank you so much...sorry for the hassle.

from maltrail.