All Apps and Add-ons

Check Hosts for Phishing Sites Visited with Phishtank csv

ktrumpol
Path Finder

Hey all,

Phishtank.com has a downloadable csv file that contains thousands of verified phishing urls. I want to compare these urls with all the weblogs of my hosts so that I can be alerted when one of my hosts accidentally stumbles upon one of these sites. Below is a sample row of the csv file. I edited the phishing url so no one would click it by accident or anything.

header row - phish_id, url, phish_detail_url, submission_time, ..., target

1932554, http://'ssl-allegrokonto.p.ht/enter_login.php.html, http://'www.phishtank.com/phish_detail.php?phish_id=1932554, 2013-07-15T12:22:00+00:00, ..., Allegro

All I am really interested in is the url data (to compare to weblogs), and possibly the target data of this file. Everything else is just extra information.

Once I have uploaded this file, how do I compose a search with components source=myweblogs and | lookup phishurls? I keep getting errors such as lookup command must come first, the lookup table phishurls is invalid, etc. Just some help on pulling out the url field of the csv file and comparing it with all my weblogs would be very helpful.

I cannot use the Phishing App on the Splunk site so just an explained search of how to do this is appreciated.

Thanks for any help provided.

0 Karma

venkatesh_gopal
New Member

Hi Nimish Doshi,

We are unable to install the phish tank app in our splunk instance. We reached to our support team and seems that the requested app isn't compatible with the version of splunk running on the splunk cloud instance. (Our version - 7.0.2.1) Splunk Vendor recommended reaching out to the Apps developer in order to have them update the compatibility of the app.

Is there anything that you could help us on this? Any suggestions on how we proceed further in installing the app with the current version? Or Splunk version needs to be upgraded or phishtank available with compatability?

0 Karma

ndoshi
Splunk Employee
Splunk Employee

Have you seen this app template? It may give you some ideas on using the Phishtank CSV data. I do use a lookup.

http://splunk-base.splunk.com/apps/47440/phishing-lookup

0 Karma

ktrumpol
Path Finder

That's actually what gave me the idea. The problem is I can neither download or upload that app due to lack of permissions.

0 Karma

venkatesh_gopal
New Member

Hi Nimish Doshi,

We are unable to install the phish tank app in our splunk instance. We reached to our support team and seems that the requested app isn't compatible with the version of splunk running on the splunk cloud instance. (Our version - 7.0.2.1) Splunk Vendor recommended reaching out to the Apps developer in order to have them update the compatibility of the app.

Is there anything that you could help us on this? Any suggestions on how we proceed further in installing the app with the current version? Or Splunk version needs to be upgraded or phishtank available with compatability?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...