How to use externbal blacklist/whitelist to filter syslog files?

[splunkboob]

im trying to setup splunk to find suspicious traffic in incoming and outgoing traffic. right now im trying to exclude traffic that comes from places that are not suspicious (whitelist) like social media websites, news websites, internal traffic etc. and use a blacklists to trigger alerts if it tries to connect to my IP. im not sure where to start here, is this even possible in splunk? there are existing blacklists online that use an api key to connect to for that blacklist, can i use that api key in splunk? do i download an entire database and upload it under my C: drive? i really hope you guys can help me here

[diogofgm · Accepted solution]

You can use lookups for that.
As an example:
with a csv with

url,blacklist
myurl.com,true

You can then use a lookup with this csv to output the blacklist find and then use it as a filter "blacklist=true".

As for other ways to accomplish that using the online blacklists with API keys, Splunk Enterprise doesn't have  functionality out of the box but Splunk Enterprise Security (SIEM) does have builtin functionality that allows you to setup downloads of threat intel like that and then have a correlation search to look for connections to threat IPs.
From docs: https://docs.splunk.com/Documentation/ES/7.0.0/Admin/Addthreatintel