Skip to main content

Search

How can I ignore IPs and Ports from hitting my Canary?

Reduce false positives on your Canaries by ignoring trusted IPs and ports. Easily add known sources, customise rules with wildcards, and keep alerts focused on real threats.

To decrease false positives, you can ignore traffic from known traffic sources (such as internal scanners).

Step 1: Log in to your console

Log in to your Console.

Console Login.png

Step 2: Open Global Settings

Click on the Gear Icon and select Global Settings.

global settings.png

Step 3: Enable Ignore IPs

Click on Ignored IPs and Ports and then enable Ignore these IPs and Ports from the menu.

CleanShot 2024-09-13 at 15.25.00@2x.png

Step 4: Add IP address to ignore

There are a few different options when it comes to the Ignored IPs and Ports feature.

  • Comments can be added to help organise the list.

CleanShot 2024-09-13 at 15.16.19@2x.png

  • A wildcard ( * ) can be used on the last byte.

CleanShot 2024-09-13 at 15.16.33@2x.png

  • Ignore based on single IP Addresses.

CleanShot 2024-09-13 at 15.16.44@2x.png

  • Ignore based on a single IP Address and Port.

CleanShot 2024-09-13 at 15.17.40@2x.png

  • Multiple IP ranges are separated by commas ( , )

CleanShot 2024-09-13 at 15.23.38@2x.png

  • Ignore a port from all IP addresses.

CleanShot 2024-09-13 at 15.17.52@2x.png

  • Ignore Port Scan activity from a single IP address.

CleanShot 2024-09-13 at 15.18.01@2x.png

 

Read more:

Was this article helpful?
3 out of 4 found this helpful
Return to top