Splunk Search

How to create a rule that does a search against phishtank.com

ahmar74
Explorer

basically i want to be able to search if users have visited sites that are listed in phishtank.

Tags (1)
1 Solution

hrottenberg_spl
Splunk Employee
Splunk Employee

The Phishing Lookup app will enable this use case for you.

View solution in original post

hrottenberg_spl
Splunk Employee
Splunk Employee

The Phishing Lookup app will enable this use case for you.

hrottenberg_spl
Splunk Employee
Splunk Employee

Right you are, @martin_mueller, I'll ping the blog post author and ask him to fix the link.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The link in that blog is broken, apparently http://apps.splunk.com/app/995/ is correct... there's a colon missing after http.

0 Karma

bowendenning
Path Finder

This would make a great TA. If I have time I might even have a go a writing one myself.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Sounds like a job for a scripted lookup. Write a script that performs a query against whatever API phishtank has, and set that up as a lookup for your data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...