I have an issue which I can't resolve. I have Googled this a lot but can't understand how I can achieve my goal.
I am sending Suricata alerts to Splunk. They are in JSON format. There are tons of alerts, so I want to make a filter. Most of them of course are False-Positive. I know about Suricata disable.conf and threshhold.conf but they can't provide the level of accuracy I need. Disable.conf will totally disable, but this can be appropriate only for a few rules. Threshold.conf can disable alerts based on src_ip or dst_ip, not both, and without mention of ports. So, Suricata doesn't provide any mechanism to effectively filter alerts. Provided methods can only make very "rude" filtering.
What I want is to filter events based on src_ip, src_port, dest_ip, dest_port.
Also there must be someplace where I could store and update conditions.
CSV file and lookup seem suitable for this purpose.
For example, I have a regular alert which has these values:
So, I need to make a search in Splunk that is similar to something like the following: "Show me all alerts except some of them which can be excluded based on conditions from a lookup (which is based on CSV)."
I made something close to my goal, but it doesn't work the way that I need it to.
[inputlookup suricata_alerts_exclusions | fields sid | rename sid as alert.signature_id] AND
[inputlookup suricata_alerts_exclusions | fields s_ip | rename s_ip as src_ip] AND
[inputlookup suricata_alerts_exclusions | fields s_port | rename s_port as src_port] AND
[inputlookup suricata_alerts_exclusions | fields d_ip | rename d_ip as dest_ip] AND
[inputlookup suricata_alerts_exclusions | fields d_port | rename d_port as dest_port]
src_ip - ANY
src_port - ANY
dst_ip - 192.168.1.2
dst_port - 445
As you can see, I have strict conditions for Signature ID 1111. But because of wildcards in the third row it applies to any row in the CSV. In other words, this search considers any value from any row.
Obviously, my search returns all events which simultaneously correspond to ANY of values in the COLUMN (in CSV). They are not limited by rows.
Please give me some advice on how to create a search that will be able to process the aforementioned CSV's correctly. Or maybe there is another way to filter events by "sid","s_ip","s_port","d_ip","d_port" using exact or wildcard values.