topic Re: Reduce specific logging in Installation

Reduce specific logging

mmoermans — Tue, 04 Jul 2017 09:42:38 GMT

When there's a huge influx of incoming logging of blocked attempts on the firewall from one specific (external) source, is it possible to (temporarily) decrease/disable the amount of logging being received from this specific source so it doesn't flood our license when it's a known issue?

Thanks in advance for the response

Re: Reduce specific logging

gcusello — Tue, 04 Jul 2017 14:53:43 GMT

Hi mmoermans,
it's possible to create a filter but the problem is that you have to restart Splunk to enable it.
At this point it's easier to stop log forwarding from your firewall and restart it after the tempest.
Bye.
Giuseppe

Re: Reduce specific logging

adonio — Tue, 04 Jul 2017 15:03:09 GMT

hello there,
i am not aware of anything "out of the box" that splunk has for that situation, if there is, would love to learn about it.
With that being said, one thing i can think of is setting an alert on your condition,
add trigger a script to that alert and have the script writing props and transforms that sending the unwanted data to nullqueue. Challenge here is how you reset back to your original configurations. maybe the script will also have a timer to reset after X amount of time.
there are other challenges with that approach, specially if this is a clustered environment.
hope it slightly helps

Re: Reduce specific logging

woodcock — Tue, 04 Jul 2017 15:08:54 GMT

The only practical way is to stop splunk on that forwarder (host).

Re: Reduce specific logging

woodcock — Tue, 04 Jul 2017 15:12:34 GMT

Why don't you manually null-route the attacking host's IP on the attacked device so it can no longer attempt to connect? Then the failed logins do not happen. For that matter, why is this kind of mitigation not automatically in place in your network (e.g. fail2ban or whatever)? Remove it when the proper configuration is in place.

https://en.wikipedia.org/wiki/Null_route
P.S. I know that this is not an "attack".

Re: Reduce specific logging

woodcock — Fri, 08 Nov 2019 15:10:20 GMT

Thesplunky way to do this now is with Phantom-based automation.