Knowledge base
Knowledge base
Breadcrumbs

HIAB E-mail Whitelisting

Last Updated: 2024-04-08



Purpose

This article describes what emails to whitelist when setting up a HIAB.

Introduction

This article outlines the email addresses that need to be whitelisted when configuring a HIAB for monitoring and alerts. It emphasizes the importance of proper filtering to avoid missing potential breaches due to false negatives while suggesting that filtering should be based on the origin of traffic or payloads. Additionally, any updates to this list of email addresses will be documented in the Release Notes.


Whitelist Addresses

The following addresses that needs whitelisting is:

  • nobody@example.com

  • postmaster@<domain>

  • probe@<domain>

  • test_1@<domain>

  • test_2@<domain>

  • root@localhost

  • root@host1@localhost

The <domain> is by default outpost24.com unless it has been manually configured in the scan policy as described in the Mail section in Scan Scheduling.

If alerts is subdued based on payload, such as the listed email addresses, it can lead to an exploitation using new vulnerabilities you may not have addressed which can be missed. This can in turn lead to completely missing a breach in your organization.

The recommendation is that the filtering is based on the origin of the traffic or payloads. This still allow filtering out all false positives for alerts in your monitoring, while also ensuring that you are not impacted by potentially dangerous false negatives.


This list may change as we add new detection scripts, any future changes or additions to these email addresses will be included in the Release Notes.



Related Articles