All Apps and Add-ons

Comodo C2 Reported as High Severity Intrusion by Infosec App

frednuffer
Explorer

All,

I am running the Infosec App on Splunk Enterprise. The app is pulling all the good information and populating its dashboards.

We use Comodo on our Windows clients and the Infosec App is flagging the C2 IP that the Comodo client reports to as a High Severity Intrusion.

Can I whitelist the Comodo IP to prevent the Infosec app from alerting against it?

1 Solution

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @frednuffer, you can filter out the IP using basic Splunk Enterprise capabilities but a couple of comments/questions first:
- do you mean the Comodo IP is flagged as a suspected C2 communication or it shows up under IDS/IPS?
- If it is showing up as an intrusion on IDS/IPS reports, another intrusion detection mechanism in your environment is picking the IP as an intrusion;
- If the IP is showing up under suspected C2 communication, one of simple ways to filter out an IP:

You can change the searches populating the InfoSec dashboards. For example, you can edit a dashboard, open the report you want to change and add a filter like the one below to the search string.

NOT dest=2.2.2.2

alt text

View solution in original post

0 Karma

frednuffer
Explorer

Thank you for the reply!

  • do you mean the Comodo IP is flagged as a suspected C2 communication or it shows up under IDS/IPS?
  • It shows up under IDS/IPS as a suspected scanning attack.

  • If it is showing up as an intrusion on IDS/IPS reports, another intrusion detection mechanism in your environment is picking the IP as an intrusion;

  • Yes - this is flagged by our Fortinet firewall. I am working with the network admin to whitelist the IP on the firewall level, but I suspect I will continuously run into items like that as we build our infrastructure out. I am looking for a method of handling this from the Splunk side as well as the firewall side.

  • If the IP is showing up under suspected C2 communication, one of simple ways to filter out an IP:
    | tstats summariesonly=true allow_old_summaries=true dc(IDS_Attacks.signature) as attack_count from datamodel=Intrusion_Detection.IDS_Attacks where * IDS_Attacks.severity=* by IDS_Attacks.src
    | rename "IDS_Attacks.src" as src, "IDS_Attacks." as ""
    | sort 5 - attack_count
    | search "src"!=2.2.2.2

This works for the dashboard, but the correct solution is to modify the firewall config.

igifrin_splunk
Splunk Employee
Splunk Employee

Hi @frednuffer, you can filter out the IP using basic Splunk Enterprise capabilities but a couple of comments/questions first:
- do you mean the Comodo IP is flagged as a suspected C2 communication or it shows up under IDS/IPS?
- If it is showing up as an intrusion on IDS/IPS reports, another intrusion detection mechanism in your environment is picking the IP as an intrusion;
- If the IP is showing up under suspected C2 communication, one of simple ways to filter out an IP:

You can change the searches populating the InfoSec dashboards. For example, you can edit a dashboard, open the report you want to change and add a filter like the one below to the search string.

NOT dest=2.2.2.2

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...