How to use the IP Reputation App for Splunk Enterprise where Splunk Server does not have direct internet access?

[donaldwayne1975]

Looking for a way to utilize the IP Reputation App for Splunk Enterprise on a Splunk server that does not have direct access to the internet.

[mmaier_splunk]

Hi Donald,

the IP Reputation App is using a scripted lookup. This scripted lookup is a python application that performs via DNS protocol the lookup. The python library is using the DNS Server that is configured in the operating system. So your Server does not need http internet access. but it needs to be able to lookup through the configured DNS Server external requests.

you can review the project honeypot API including some examples: https://www.projecthoneypot.org/httpbl_api.php

br
Matthias