Splunk Alert - best practice input

iherb_0718 — Mon, 21 Dec 2020 06:38:29 GMT

Hello Splunkers,

I just wanted to have someone give me best practice input.

My scenario is that I have threat intelligence coming in from Threatconnect. The index is "threatconnect". Threatconnect is auto-tagging any IOCs related to the solarwinds breach as "solarwinds breach" and I've seen other tags come in with the word "solarwinds" so I will wildcard it. The event which this comes in under is in field "event.ts_detail".

I run this search and I see activity:

index=threatconnect event.ts_detail=*solarwinds*

However, all the activity I am seeing is an IP brute forcing us constantly. It comes in as this field event.src=45.129.33.129

Therefore, I created an alert with this search which runs every hour:

index=threatconnect event.ts_detail=*solarwinds* event.src!=45.129.33.129

My question to you:

Is this best practice to set the alert and ignore something that I don't care about (IP 45.129.33.129 since it's only probing).

Would you do it differently?

Re: Splunk Alert - best practice input

iherb_0718 — Mon, 21 Dec 2020 07:55:46 GMT

I believe I'm better off with putting the exclusions from an input table so that it will be easier for me to exclude additional IPs.

Suppose I make the exclusion as a lookup file called: Solarwinds_whitelist_IOC.csv

What would the syntax be for me to call on this input table to NOT include?

topic Splunk Alert - best practice input in Splunk Cloud Platform

Splunk Alert - best practice input

Re: Splunk Alert - best practice input