topic Re: How to use a list of allowable IP addresses in Splunk Search

How to use a list of allowable IP addresses?

kevinb0011 — Tue, 27 Sep 2022 13:44:09 GMT

Good morning,

Curious to see if anyone has used a similar dataset in Splunk and/or any suggestions on the best way to create a usable solution.

I have a list of IP addresses, and for each IP address there is a list of allowable systems (IPs) . If any of the IP addresses communicate with systems outside of the allowable list I want to be alerted. I know I can probably create individual alerts for each of these but would like to be able to process these in bulk. For example, if Splunk could periodically cross reference the IP list against the network data to see if there are any violations. Could a lookup table be used for this?

Re: How to use a list of allowable IP addresses

gcusello — Tue, 27 Sep 2022 12:08:18 GMT

Hi @kevinb0011,

you can use a lookup (called e.g. your_lookup.csv) to store the allowed IPs and then run a search:

at first you have to define the fields containing IP to monitor and then run something like this:

index=* | eval ip=coalesce(src,src_ip.dest, dst,dest_ip,dst_ip) | search NOY [ | inputlookup your_lookup.csv | fields ip ]

in this way list all the IP in the choosen fields not listed in the lookup.

Ciao.

Giuseppe

Re: How to use a list of allowable IP addresses

kevinb0011 — Tue, 27 Sep 2022 12:43:00 GMT

Great thank you for the quick response. I'm going to try this out asap.

Curious as to how much this complicates things, but what if the allow list is unique per IP. So each IP could have similar or different allowed communicants. Could this be captured in one lookup table?

For example:

Main IP List Allowed IPs

10.0.0.1 (10.1.0.0, 10.2.00, 10.3.00)

10.0.0.2 (10.0.1.0, 10.0.2.0)

10.0.0.3 (192.168.1.1, 10.1.0.0)

Re: How to use a list of allowable IP addresses

gcusello — Tue, 27 Sep 2022 12:46:57 GMT

Hi @kevinb0011,

in the allow list you can use asterisk (10.1.0.*) or subnets (10.1.0.0/24).

The main problem, is to identify all the fields that could contain ip addresses and put them in the coalesce command.

Ciao.

Giuseppe

Re: How to use a list of allowable IP addresses

kevinb0011 — Tue, 27 Sep 2022 13:14:30 GMT

ok great thanks

Re: How to use a list of allowable IP addresses

gcusello — Tue, 27 Sep 2022 13:21:32 GMT

Hi @kevinb0011,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉