Is there an equivalent of HP Arcsight's "Active Lists" in Splunk for correlation rules?

[mkallies]

We're going to be deploying Splunk as an SIEM shortly.

In past engagements, I've used HP Arcsight, and used their "Active Lists" extensively. These are small tables (from a handful to a tens of thousands of entries) which can be used in real-time to help build correlation rules.

E.g., if an IPS scan signature trips, it will add to an "Attackers" active list. If another signature fires such as "brute force login", from somebody in the "Attackers" list, it would cause a high severity correlated event to fire. The list might have a 6 hour expiration so that entries drop off eventually.

Another example was an active list I produced which had the manufacturer MAC OUI database loaded. Any time a machine was plugged in which was not from a vendor we indicated was "acceptable", an alert would fire.

I'm a total n00b. I've installed and played with Splunk, but not done much else. Is there an equivalent in functionality for Splunk?

Thanks,

[smoir_splunk]

@mkallies replying to an old question, but the most recent version of ES (4.2) introduced the concept of a "search-driven lookup" which uses a search to maintain a lookup table. It should be similar to the behavior that you're expecting from active lists. Read more about it here: http://docs.splunk.com/Documentation/ES/4.2.0/User/Applicationprotocolsblacklist#Search-driven_looku...

[jplumsdaine22]

You should probably have a chat to your sales rep about this add on: http://www.splunk.com/en_us/products/premium-solutions/splunk-enterprise-security.html

If you want to DIY it, I would familiarize yourself with the search tutorial first: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchTutorial/WelcometotheSearchTutorial

Then have a look at the KV store http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/ConfigureKVstorelookups

There are also apps for splunk that work with IPS systems - there may be one available for your vendor.

[mkallies]

I'm glad that I kept the Enterprise security module in our requirements... we're strapped on manpower and I'm betting the head-start on content development will be helpful.

The search tutorial is excellent, I've already gone through it.

Now the KVstore stuff, that's very new to me. I'm going to do some digging on its abilities.

Thanks for the tips!