Manage Artica PCAP Filter whitelists
The Whitelist is a software-internal database that automatically authorizes addresses and networks.
The list of authorized addresses allows addresses to be automatically defined as "CLEAN" and not subject to detection or remediation.
Whitelist an IP address
Use the -whitelist-add [IP/CIDR/file] token to add IP records to the whitelist database
articapsniffer -whitelist-add 1.2.3.4
articapsniffer -whitelist-add 1.2.3.0/24
articapsniffer -whitelist-add /home/firewall/whitelist.txt
Use the -whitelist-del [IP/CIDR/file] token to remove IP records from the whitelist database
articapsniffer -whitelist-del 1.2.3.4
articapsniffer -whitelist-del 1.2.3.0/24
articapsniffer -whitelist-del /home/firewall/whitelist-del.txt
Use the -whitelist-add [IP/CIDR/file] token to add IP records to the whitelist database
Whitelist a domain
Use -whitelist-add-domain [domain] to add a domain to the whitelist database (a domain that is part of a resolved IP address)
articapsniffer -whitelist-add-domain bl.google.com
Use -whitelist-del-domain [ID] to delete a domain from the whitelist database using the id of the record
List all whitelists
Use the -whitelist-list token to list records stored in the whitelist database