IP Reputation App. No data

[marius00]

Hello

I installed the IP Reputation app. Added my HTTPBL key to scorelookup.py script. I have not configured anything else.

When I launch the app. I get no results.

Should I re-install the app? Or have I forgotted to configure something?

[Matthias_BY]

Hello Marius,

i just updated my app with a new version. i have configured a new start dashboard which includes already some simple xml reports. there you can easily review how the reports are working and customize them with your own needs.

hope this helps you.
br
matthias

[Matthias_BY]

Hello Marius,

what kind of log data are you using?

The predefinied dashboards are filtered down to eventtype="honeypot_app_events" - this means you need to Tag your log source of which you want to see your data and enrich those.

to verify if you ip reputation lookup is working, you need to do the following:

1. Create some Field Extractions with IP's and name the fields "clientip"
2. Search for some periode of time like clientip=* | lookup threatscore clientip
3. Verify if there is a new field called "threatscore" within the "interesting fields"

The filtering was added to avoid that if you click on your dashboard the lookup is starting across all your it-data. the lookup is going via DNS Requests - and if Splunk runs for thousands of IP's a dns query you can imagine what happens to your DNS Server 😉 so use it only on data which you're really interested.

br
Matthias