All Apps and Add-ons

External threat feed database lookup

Motivator

I created a SQL server db table that contains various IPs from open source IP block lists (zeustracker, dshield, stop forum spam). I am currently in the process of creating the DB Lookup within the Splunk DB Connect v2 app.

What I'd like to do is compare either srcip or dstip fields from various sourcetypes against the IP list in the lookup database. In the 'Choose the Splunk Fields to Base the Lookup on' (Step 3 of 6) should I select multiple fields (srcip AND dstip), or do I need to create separate lookups for the srcip and dstip fields?

Thx

0 Karma
1 Solution

Motivator

Thx for link pointing to a great app! Absolutely awesome...

0 Karma

Motivator

One quick question. I created the .csv file with two columns - ip_address and feedname. How do I run the query that returns both fields?

I am running the following query:

index=main [|inputlookup threatfeed.csv | fields ipaddress,feedname | rename ipaddress as SourceIP] | stats count by SourceIP | sort -count

but it comes back and tells me, "No results found". If I remove 'feedname' I get results with the count. I'd like to see the feedname column listed as well to see which threat feed the IP is associated with.

Thx

0 Karma