Dashboards & Visualizations

Exclude IP range based on dynamic file list on the web

pir8radio
Path Finder

Question, the list returned in the link posted below updates now and then. I would like a way to filter my firewall results with a dropdown to "filter cloudflare IP's" using field3. anyway i just need an example on how I could use this dynamic list link below in my search to filter out those IP ranges? any easy way? I dont want to download the file and massage it, i would rather pull it live from their server, either on a schedule or whatever, then write a search to reference that list. otherwise i have to NOT, NOT, NOT and update my search whenever the new list comes out.

Link to dynamic IP Range list:
https://www.cloudflare.com/ips-v4

Current search:
sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE Src_IP=$field3$ Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE [|inputlookup ips_v4.csv |rename _raw as Src_IP | format] Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

View solution in original post

to4kawa
SplunkTrust
SplunkTrust
sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE [|inputlookup ips_v4.csv |rename _raw as Src_IP | format] Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

View solution in original post

pir8radio
Path Finder

see I thought of that but didn't try it, I didn't think the format would have worked. I'll give it a go, thanks.

0 Karma

pir8radio
Path Finder

but how do I add a web link as the lookup without manually downloading/uploading the file? I want this to happen automatically.

0 Karma

to4kawa
SplunkTrust
SplunkTrust

you should make add_on or script.

0 Karma

pir8radio
Path Finder

ok thats what i thought... Thanks, ill just grab the results in a powershell script and write to a file on schedule. Thanks.

0 Karma

to4kawa
SplunkTrust
SplunkTrust

If you make apps, mkdir lookups and put on your Csv.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!