Hello
I installed the IP Reputation app. Added my HTTPBL key to scorelookup.py script. I have not configured anything else.
When I launch the app. I get no results.
Should I re-install the app? Or have I forgotted to configure something?
Hello Marius,
i just updated my app with a new version. i have configured a new start dashboard which includes already some simple xml reports. there you can easily review how the reports are working and customize them with your own needs.
hope this helps you.
br
matthias
Hello Marius,
what kind of log data are you using?
The predefinied dashboards are filtered down to eventtype="honeypot_app_events" - this means you need to Tag your log source of which you want to see your data and enrich those.
to verify if you ip reputation lookup is working, you need to do the following:
clientip=* | lookup threatscore clientip
The filtering was added to avoid that if you click on your dashboard the lookup is starting across all your it-data. the lookup is going via DNS Requests - and if Splunk runs for thousands of IP's a dns query you can imagine what happens to your DNS Server 😉 so use it only on data which you're really interested.
br
Matthias