All Apps and Add-ons

How to use getwatchlist and lookup to find malware domains in DNS logs?

packet_hunter
Contributor

Scenario: I am trying to check my DNS logs for queries to malicious domains on the getwatchlist [http://mirror1.malwaredomains.com/files/domains.txt].

So far I have reformatted my DNS queries (e.g. from: (14)registerdisney(2)go(3)com(0) to: registerdisney.go.com) with the following code

index=DNSlogs | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") | stats list(*)

Now I need to correlate my [reformattedDomain] to the [domain] field in malware_domainsdm.csv and the following code works:

|getwatchlist malwaredomains | outputlookup malware_domainsdm.csv

I get these fields [ domain, category, reference, date] however I am not finding the right syntax to make the connection.

Please provide any examples.

Thank you!

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

You can try adding something like this to the end of your search:

| lookup malware_domainsdm.csv domain AS reformattedDomain | search category=*

which would perform the lookup against the downloaded list, using the reformattedDomain as the key against the values in the domain field. Then the search command filters the results to only show the items for which the lookup was successful. You may not want the stats portion of the search you have in your search.

HTH,

Dave

View solution in original post

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You can try adding something like this to the end of your search:

| lookup malware_domainsdm.csv domain AS reformattedDomain | search category=*

which would perform the lookup against the downloaded list, using the reformattedDomain as the key against the values in the domain field. Then the search command filters the results to only show the items for which the lookup was successful. You may not want the stats portion of the search you have in your search.

HTH,

Dave

0 Karma

packet_hunter
Contributor
index=msad | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1")
|stats count by reformattedDomain 
|lookup malware_domainsdm.csv domain AS reformattedDomain  
| eval domainmatch=if(reformatedDomain==domain, "bad", "good")

This gets me closer but I am having trouble populating the other malwaredomaindm.csv fields like category, date, and reference. Any ideas?

Thank you

0 Karma

packet_hunter
Contributor

Thanks Dave, before I accept, do you know how to write an [eval domainmatch = if (reformattedDomain = domain) then add a value of good or bad in a new domain field?

Thanks

0 Karma

dshpritz
SplunkTrust
SplunkTrust

I think you want something like:

| eval domainmatch=if(reformatedDomain==domain, "bad", "good") 

You could also try:

| eval if(isnull(category), "good", "bad")
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...