All Apps and Add-ons

How to use getwatchlist and lookup to find malware domains in DNS logs?

packet_hunter
Contributor

Scenario: I am trying to check my DNS logs for queries to malicious domains on the getwatchlist [http://mirror1.malwaredomains.com/files/domains.txt].

So far I have reformatted my DNS queries (e.g. from: (14)registerdisney(2)go(3)com(0) to: registerdisney.go.com) with the following code

index=DNSlogs | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") | stats list(*)

Now I need to correlate my [reformattedDomain] to the [domain] field in malware_domainsdm.csv and the following code works:

|getwatchlist malwaredomains | outputlookup malware_domainsdm.csv

I get these fields [ domain, category, reference, date] however I am not finding the right syntax to make the connection.

Please provide any examples.

Thank you!

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

You can try adding something like this to the end of your search:

| lookup malware_domainsdm.csv domain AS reformattedDomain | search category=*

which would perform the lookup against the downloaded list, using the reformattedDomain as the key against the values in the domain field. Then the search command filters the results to only show the items for which the lookup was successful. You may not want the stats portion of the search you have in your search.

HTH,

Dave

View solution in original post

0 Karma

dshpritz
SplunkTrust
SplunkTrust

You can try adding something like this to the end of your search:

| lookup malware_domainsdm.csv domain AS reformattedDomain | search category=*

which would perform the lookup against the downloaded list, using the reformattedDomain as the key against the values in the domain field. Then the search command filters the results to only show the items for which the lookup was successful. You may not want the stats portion of the search you have in your search.

HTH,

Dave

0 Karma

packet_hunter
Contributor
index=msad | eval reformattedDomain = replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1")
|stats count by reformattedDomain 
|lookup malware_domainsdm.csv domain AS reformattedDomain  
| eval domainmatch=if(reformatedDomain==domain, "bad", "good")

This gets me closer but I am having trouble populating the other malwaredomaindm.csv fields like category, date, and reference. Any ideas?

Thank you

0 Karma

packet_hunter
Contributor

Thanks Dave, before I accept, do you know how to write an [eval domainmatch = if (reformattedDomain = domain) then add a value of good or bad in a new domain field?

Thanks

0 Karma

dshpritz
SplunkTrust
SplunkTrust

I think you want something like:

| eval domainmatch=if(reformatedDomain==domain, "bad", "good") 

You could also try:

| eval if(isnull(category), "good", "bad")
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...