> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist.md).

# Whitelist

The whitelist for the Intrusion Detection System (IDS) allows you to classify specific activities, IP addresses, or applications as trusted and prevent them from being incorrectly detected as threats.

{% hint style="warning" %}
**Please note**: When creating whitelist entries, make sure that exceptions are defined as precisely as possible. We recommend that you avoid overly broad whitelist entries, as these undermine the security principle of the IDS, similar to an "any any" firewall rule.
{% endhint %}

***

<i class="fa-compass">:compass:</i> Navigate to **Hosts** → **Intrusion Detection System** → **Whitelist** to show a list of all whitelist entries. If you have not created any whitelist entries yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FSGdq3iIk9xMcZXwD5CMU%2Fenginsight-screenshot-hosts-ids-whitelist.jpg?alt=media&amp;token=a2bdf849-8126-45af-bb49-97bd82a0f6c1" alt=""><figcaption></figcaption></figure>

The [whitelist overview](#whitelists-overview) provides information such as:

* which source IP address is classified as trusted for which attack type.
* which host the whitelist entry applies to.

You can also [add new whitelist entries](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist/add-whitelist-entry.md).

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Filtering the List

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Filter** icon <i class="fa-filter">:filter:</i> above the list to filter the list by predefined parameters.

<details>

<summary>Available Filters</summary>

<table><thead><tr><th width="206.60546875">Parameter</th><th width="116.515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>Attack</td><td>String</td><td>Filter by a specific attack type or exclude it from the results. All available attack types are shown.</td></tr><tr><td>CIDR</td><td>String</td><td>Filter by a specific IP address range in Classless Inter-Domain Routing (CIDR) notation or exclude it from the results. All available IP address ranges are shown.</td></tr></tbody></table>

</details>

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Deleting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the corresponding item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list entries is now displayed next to the search field.

The **Delete** button <i class="fa-trash">:trash:</i> also appears in the upper-right corner. Click it, then confirm the message that appears by clicking **Delete**.

{% hint style="danger" %}
**Please note:** Deleted items cannot be restored.
{% endhint %}

***

## Whitelist: Overview

The whitelist overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2F73k0MgHuc5zh8hRmHdNG%2Fenginsight-screenshot-hosts-ids-whitelist%20overview.jpg?alt=media&amp;token=630ffaa5-f2d2-4437-a71e-84da8475b0b4" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="200.140625">Column</th><th>Description</th></tr></thead><tbody><tr><td>Source</td><td><p>Shows the source IP address that the respective whitelist entry applies to, as well as an additional description, if provided.</p><p></p><p>The date and time of creation and last edit are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click a source IP address to navigate to the <a href="#whitelist-edit-view">edit view</a> of the respective whitelist entry. Here you can adjust configured settings and delete the whitelist entry.</p></td></tr><tr><td>Attack Category</td><td>Shows the specific attack category that the whitelist entry applies to.<br><br>If the whitelist entry applies to all attack categories, this is indicated accordingly.</td></tr><tr><td>Assigned Hosts</td><td>Shows the names of the hosts that the respective whitelist entry applies to or that are excluded from it, or the tags that refer to the corresponding host groups.<br><br>If no assigned hosts could be found, this is indicated accordingly.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the name of a host to navigate to the respective <a href="/docs/manual/english/platform-usage/host-detail-view.md">host detail view</a>.</td></tr></tbody></table>

***

## Adding a Whitelist Entry

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Create Whitelist Entry** in the upper-right corner to [add a new whitelist entry](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist/add-whitelist-entry.md).

***

## Whitelist: Edit View

<i class="fa-computer-mouse">:computer-mouse:</i> Click a source IP address to navigate to the edit view of the respective whitelist entry. Here you can adjust [configured settings](/docs/manual/english/platform-usage/hosts/intrusion-detection-system/whitelist/add-whitelist-entry.md#general-settings) and delete the whitelist entry.

The following actions are available:

<table><thead><tr><th width="200.39453125">Option</th><th>Description</th></tr></thead><tbody><tr><td>Save Changes</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Save Changes</strong> after adjusting any settings.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Unsaved changes cannot be recovered.</p></div></td></tr><tr><td>Back</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Back</strong> to return to the list overview.</td></tr><tr><td>Remove</td><td><p><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Remove</strong>, then confirm the prompt that appears to delete the object that you are editing.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note:</strong> Deleted objects cannot be recovered.</p></div></td></tr></tbody></table>

***