[Enhancement Request] Allow filtering of IPs reported in network events
Open
- Dominant language
- Swift
- Stars
- 47
- Forks
- 9
- PR merge metrics
- No merged PRs in 30d
Description
Requested here:
https://discuss.elastic.co/t/policy-settings-event-collection-differentiate-public-vs-private-network-access/332661
I looked in to using event filters to provide that functionality, but I do not believe our current filter setup would be conducive or user friendly to drop network events from specific IP ranges.
Potential way forward:
1) Simple option to drop RFC 1918 IP address events
2) Allow ip+netmask filtering of the network events
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.