Dashboards & Visualizations

Exclude IP range based on dynamic file list on the web

pir8radio
Path Finder

Question, the list returned in the link posted below updates now and then. I would like a way to filter my firewall results with a dropdown to "filter cloudflare IP's" using field3. anyway i just need an example on how I could use this dynamic list link below in my search to filter out those IP ranges? any easy way? I dont want to download the file and massage it, i would rather pull it live from their server, either on a schedule or whatever, then write a search to reference that list. otherwise i have to NOT, NOT, NOT and update my search whenever the new list comes out.

Link to dynamic IP Range list:
https://www.cloudflare.com/ips-v4

Current search:
sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE Src_IP=$field3$ Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

0 Karma
1 Solution

to4kawa
Ultra Champion
sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE [|inputlookup ips_v4.csv |rename _raw as Src_IP | format] Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

View solution in original post

to4kawa
Ultra Champion
sourcetype=Firewall Dst_Port!="-" Action=ALLOW Path=RECEIVE [|inputlookup ips_v4.csv |rename _raw as Src_IP | format] Src_IP!="127.0.0.1" Src_IP!="::1" NOT (Src_IP="10.0.0.0/8" OR Src_IP="172.16.0.0/12" OR Src_IP="192.168.0.0/16")
| stats count by Src_IP Dst_Port Protocol Action
| sort -count
| rename Src_IP as "Source IP" Dst_Port as "Destination Port"

pir8radio
Path Finder

see I thought of that but didn't try it, I didn't think the format would have worked. I'll give it a go, thanks.

0 Karma

pir8radio
Path Finder

but how do I add a web link as the lookup without manually downloading/uploading the file? I want this to happen automatically.

0 Karma

to4kawa
Ultra Champion

you should make add_on or script.

0 Karma

pir8radio
Path Finder

ok thats what i thought... Thanks, ill just grab the results in a powershell script and write to a file on schedule. Thanks.

0 Karma

to4kawa
Ultra Champion

If you make apps, mkdir lookups and put on your Csv.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...