How to filter or block a specific ip in rsa

[Inspirisys]

Hi 

we are facing excessive logs from one specific internal ip. we need to block or filter the ip in our rsa tool. Can anyone help 

[NickDaino]

https://community.netwitness.com/t5/netwitness-knowledge-base/system-level-bpf-packet-filtering-best-practices-and-examples/ta-p/9515

Be very careful if you implement a packet filter that you don't accidentally block other legitimate traffic.

[YK]

It required more information, if you want to finetune, or any specific alert is generating the log, then filter that specific app rule.

[VincentWareham]

Hello Inspirisys

As will be obvious to you the best solution is to configure the device that is sending the excessive logs to stop doing that.  It will reduce the logs getting sent to NetWitness and reduce the unwanted traffic over your network.

Alternatively as NickDaino mentioned for Packet Decoder traffic you can configure Berkeley Packet Filter (BPF) rules to ignore traffic from a specific IP(s).

Reference: System-level (BPF) packet filtering best practices and examples for RSA NetWitness decoders and (Optional) Configure System-Level (BPF) Packet Filtering