Alerting

"Automate" alert actions

stwong
Communicator

Hi, we want to block malicious IP address in firewall as alert action. We run python script to block such IP address through REST api. It seems okay.

However, we're requested to unblock such blocked IP address automatically after blocking for 15 minutes. Is it possible to do so through Splunk?

Besides, shall we use webhook instead of running external scripts ?

We're using Splunk 7.0.

Thanks a lot.
Regards,
/ST Wong

Tags (1)
0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

You might be able to figure something out by writing those bad IPs to a lookup (using |outputlookup append=true)including a timestamp, and also call the REST API to block them.
You could then regularly search through that lookup, filter on entries older than 15 minutes, and have another alert action on those to have the REST API unblock them, and also drop them from the lookup.

Not exactly a complete solution, but you should be able to figure something out using those idea 😉

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

View solution in original post

xpac
SplunkTrust
SplunkTrust

You might be able to figure something out by writing those bad IPs to a lookup (using |outputlookup append=true)including a timestamp, and also call the REST API to block them.
You could then regularly search through that lookup, filter on entries older than 15 minutes, and have another alert action on those to have the REST API unblock them, and also drop them from the lookup.

Not exactly a complete solution, but you should be able to figure something out using those idea 😉

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

cygnetix
Path Finder

I would personally feel a bit uncomfortable doing this from core Splunk. Have you taken a look at Splunk's recent acquisition https://phantom.us?

It's yet another product to deploy and pay for but it'd designed for exactly this type of orchestration task. While I think you could do it in Splunk using a combination of searches and the kvstore, I would worry that it'd be quite complicated and brittle and is getting a little outside of Splunk's core capabilities and intended purpose.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...