All Apps and Add-ons

How I can use IP-reputation with snort alert logs?

hespinoza
New Member

hello:

How I can use IP-reputation with snort alert logs?

thanks

0 Karma

hespinoza
New Member

EXTRACT-clientip = (?\d+.\d+.\d+.\d+)(?::\d+)* -> \d+.\d+.\d+.\d+(?::\d+)\s$

0 Karma

Matthias_BY
Communicator

Hi,

you need to extract the source ip address into the "clientip" field. once done you can create lookups with

| lookup threatscore clientip | table clientip threatscore

you'll then have a table with all attacking ip's + the threat score enriched. In case you have a lot of logs - you might do this via summary reports to avoid that everytime you review your report it's loaded and the lookup is generating a lot of dns requests.

br
matthias

0 Karma

Ayn
Legend

Well how DO you want to use IP reputation with snort alert logs?

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...