Getting Data In

How to compare IP blacklists

nebblkshts
New Member

I want to either compare natdst to a blacklist.
We do not have a subscription to any service that provides blacklist but I see some free list.
I am assuming since we do not pay for a service, I have to download a CSV and compare that way.

0 Karma

woodcock
Esteemed Legend

There is an app for that called Getwatchlist Add-on for Splunk Enterprise:
https://splunkbase.splunk.com/app/635/

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nebblkshts,
You have to load csv in a lookup (called e.g. ip_blacklist.csv) and then use a search like this:

index=my_index [ | inputlookup ip_blacklist.csv | fields source_ip ]
| stats count BY source_ip

put attention to the fieldname between logs and lookup: they must be the same, if they are different, in the subsearch you have to insert a rename.

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nebblkshts,
if you're satisfied by this answer, please accept and/ot upvote it.
Bye, see at next time.
Giuseppe

0 Karma

nebblkshts
New Member

Thank you, that worked.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...