IP Reputation configuration

[widj91942]

I am trying to use IP Reputation apps, however the graph does not show anything. It seems it requires some of the fields that is not available in my installation. Some of the fields are src_ip dst_ip dst_port protocol.

Is there any additional setup that we need to do to use IP Configuration, in addition to include BL key from projecthoneypot?

Any help is greatly appreciated

[Matthias_BY]

Hello Widj,

you can use the existing dashboards to map your data on it by doing field extractions or creating field aliases with the naming you figured out already. Additional you need to tag the events that should be mapped to the dashboard. Use eventtype=ip_check.

the event type was added because you might want to map and lookup only specific data and not all your traffic which would lead in many dns lookups. So for example the event type "check_ip" could be defined as only logs that have a dst_ip field and where the destination is not an internal network address (10.X in this sample): "dst_ip=* NOT 10.*"

you can also go into the search app of "IP Reputation" and search for:

your filtered data | lookup threatscore clientip AS <yourfield with external ip address that should be checked> | table _time <yourfield with external ip address that should be checked> threatscore

from the dashboards:

**eventtype="ip_check"** | stats count by src_ip dst_ip dst_port protocol | lookup threatscore clientip AS dst_ip | sort -threatscore | stats count(dst_ip) as total_connections count(eval(threatscore>0)) as count_bad | eval percentage = count_bad * 100/total_connections | table percentage | eval percentage = round(percentage,2) | rename percentage as "Percentage ip destinations bad"

br
Matthias