topic Re: Add domains to threat lists in Security

Add domains to threat lists

Sam2 — Wed, 02 Apr 2014 13:25:37 GMT

I'm looking at using Threat Lists to manage local lists of known malicious websites that I see traffic to. However, from the documentation, it seems that the threat lists are only able to work with IP addresses, not domains.

Is there anyway to get Threat Lists to work with domains rather than IPs?

If not, what would be the best way to approach this?

Re: Add domains to threat lists

dragoslungu — Tue, 01 Jul 2014 17:55:15 GMT

Sam, any update on this one ? I'm facing the exact same issue and I tend to believe only IP addresses are supported. Thanks !

Re: Add domains to threat lists

Sam2 — Mon, 14 Jul 2014 08:21:00 GMT

Splunk confirmed that only IPs are useable in threat lists. You have to create your own lookups to have domains.

Re: Add domains to threat lists

mcronkrite — Mon, 28 Sep 2020 19:18:39 GMT

Create a csv file for your domain threat list.
Upload the csv file to SplunkEnterpriseSecuritySuite/lookups
Create a lookup definition.
Create a threatlist definition.

[threatlist://malwaredomains]
delim_regex =,
description = "Threatlist:Malware domains"
fields = domain,description,category,risk
skip_header_lines = 1
type = "Threatlist:Malware"
url = "lookup://"
weight = 90
Make sure that the data source you want this threat list to match has the DEST field populated with a domain value.