topic Re: IOC threat hunting in Splunk Search

IOC threat hunting

mackey — Fri, 01 Nov 2024 06:18:43 GMT

We deal with hundreds of iocs ( mostly flagged IP's) that come in monthly, and we need to check them for hits in our network. We do not want to continue using summary search one at a time. Is it possible to use lookup table ( or any other way) to search hundreds at a time or does this have to be done one at a time. I am very new to splunk and still learning. I am needing to see if we have had any traffic from these or to these IP's.

Re: IOC threat hunting

gcusello — Fri, 01 Nov 2024 10:49:27 GMT

Hi @mackey ,

if you have these IOCs in a lookup table you can run a very simple search:

if your lookup is called my_ioc.csv and the ip list is in a column alled ip, you could run:

index=* [ | inputlookup my_ioc.csv | rename ip AS query | fields query ]

in this way you execute a search for all the ips listed in your lookup in full text search on all your events.

If instead you want to search these ips in pre-defined fields, you have only to change the field name in the subsearch, es. if you want to search in the src field, you could run:

index=* [ | inputlookup my_ioc.csv | rename ip AS src | fields src ]

Ciao.

Giuseppe

Re: IOC threat hunting

Bhumi — Fri, 01 Nov 2024 11:08:50 GMT

Hi @mackey

Is your Org using Enterprise Security of Splunk?

Re: IOC threat hunting

gcusello — Fri, 01 Nov 2024 13:33:58 GMT

Hi @mackey ,

this solution is if you don't have Enterprise Security.

If you have ES, you can add your IOC list to the threat intelligence lookups.

Ciao.

Giuseppe

Re: IOC threat hunting

mackey — Sat, 02 Nov 2024 04:24:47 GMT

I have access to ES yes.

Re: IOC threat hunting

Bhumi — Sat, 02 Nov 2024 05:03:48 GMT

Hi @mackey

If you have ES, it has a framework called "THREAT INTELLIGENCE" for managing threat feeds, detecting threats, and sending alerts. You should explore this functionality, as it can be quite beneficial. Additionally, there are several other high-quality sources of threat data available in that which just need to be activated if required OR if you have your own custom feeds, you can also integrate them as custom lookups in threat intelligence.

As mentioned by @gcusello you have two options , explore it as per your requirement.

For more info on this , please refer the below docs:

https://lantern.splunk.com/Security/UCE/Guided_Insights/Threat_intelligence/Using_threat_intelligence_in_Splunk_Enterprise_Security

https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/threatintelligenceframework/

https://www.splunk.com/en_us/pdfs/feature-brief/splunk-threat-intelligence-management.pdf

If this helps, accept the answer by upvoting !!

Happy Splunking !!