All Apps and Add-ons

Getwatchlist Add-on for Splunk Enterprise: common lookup format and https proxy

dominiquevocat
Motivator

Is there some kind of definition of what info gets to be placed in what field? Some sources deliver CIDR, some deliver IP, some deliver DNS domains etc. Is there a definition of what the lookup table should look like that gathers all sources and provides a systemwide lookup?
I would like to gather a global list of suspicions internet destinations and/or client IPs

Also, urllib has issues with https via proxy and I have good experiences with the requests library. Any chance the author will consider using that library?

0 Karma

dshpritz
SplunkTrust
SplunkTrust

There is no guidance on what the lookups should look like, getwatchlist is just a tool that you can use to grab a URL and make a lookup. How you map those for your use is really up to you. Some examples can be found in the config, or here:

Splunk Blogs
Stratum Security

Also, keep in mind that you can map fields using the "=", so for example, if the 4th column in the retrieved file is the name of the contributor, and you wanted it to be mapped to a field named "contributor" you can add "4=contributor" to the command to create that mapping.

As for the use of the requests library, that would be a possibility for the future, but I currently don't have any plans on when the next release would be.

Thanks,

Dave

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...