Getting Data In

Cisco appz for all addresses

cmeo
Contributor

I'm in the process of figuring out the cisco-related apps and add-ons, and one notable point is that by default 10.* and 192.* RFC 1918 private IPs are excluded. Our customer specifically wants to know what his internal users are doing. What changes do I make to include all internal as well as external addresses?

Incidentally by not filtering out 172.* addresses as well, this doesn't work properly anyway.

Will probably knows this one 🙂

Will_Hayes
Splunk Employee
Splunk Employee

Hi, Can you elaborate a bit on what you mean by excluded. The only exclusion that I'm aware of is the flash maps will omit internal IPs by default since they will fail a geo lookup. You can have this function work on internal IPs we just need to provide the geo translation through another means. is there exclusion taking place anywhere else in the add-ons?

0 Karma

cmeo
Contributor

Here is the search:
search = eventtype=cisco_* src_ip=* src_ip!=10.* src_ip!=192.* src_ip!=0.0.* | stats count by src_ip | eval count_label="Cisco Security Event" | eval iterator="src_ip" | eval iterator_label="IP" | eval movie_color="#FF0000" | eval output_file="home_threat_data.xml" | eval app="SplunkforCiscoSecurity" | lookup geoip clientip as src_ip | mapit

If I understand the filtering correctly, this will exclude any internal addresses (except for 172.*) from the results altogether, not just for mapping purposes. So, how do you set up internal mapping?

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...