1.4.0 Whitelist changes?

olafhartong / ThreatHunting

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

MIT License

1.12k stars 177 forks source link

1.4.0 Whitelist changes? #28

Closed billmurrin closed 5 years ago

billmurrin commented 5 years ago

Hi Olaf,

Per the Changelog of 1.4.0:

Rebuilt the whitelisting, searches are a LOT quicker now and take less resources

Our team would like to know if you can elaborate on what you mean by rebuilt the whitelisting? Does this affect the whitelists that we are currently using for the TH App? We are hesitant to upgrade because we don't want to have to redo or lose any of the whitelisting we have done so far. Thanks in advance.

olafhartong commented 5 years ago

Hi Bill,

No need to worry, the change is not affecting the lookup files at all. I try to make as little changes as possible to the functionality of the app. The way I created the searches that excluded all whitelists was not according to the best practice and was causing significant issues when a whitelist would exceed a certain size. It created a not search for all entries where I now do this in memory, which is a lot less resource intensive and quicker.

billmurrin commented 5 years ago

Hi Olaf,

That is a relief and I am glad to hear that we can look forward to some speed improvements in this area. I am a big fan of the work you have done here. Greatly appreciated and Thank you!