Getting Data In

How to use externbal blacklist/whitelist to filter syslog files?

splunkboob
Explorer

im trying to setup splunk to find suspicious traffic in incoming and outgoing traffic. right now im trying to exclude traffic that comes from places that are not suspicious (whitelist) like social media websites, news websites, internal traffic etc. and use a blacklists to trigger alerts if it tries to connect to my IP. im not sure where to start here, is this even possible in splunk? there are existing blacklists online that use an api key to connect to for that blacklist, can i use that api key in splunk? do i download an entire database and upload it under my C: drive? i really hope you guys can help me here

Labels (3)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

You can use lookups for that.
As an example:
with a csv with

url,blacklist
myurl.com,true

You can then use a lookup with this csv to output the blacklist find and then use it as a filter "blacklist=true".

As for other ways to accomplish that using the online blacklists with API keys, Splunk Enterprise doesn't have  functionality out of the box but Splunk Enterprise Security (SIEM) does have builtin functionality that allows you to setup downloads of threat intel like that and then have a correlation search to look for connections to threat IPs.
From docs: https://docs.splunk.com/Documentation/ES/7.0.0/Admin/Addthreatintel

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

You can use lookups for that.
As an example:
with a csv with

url,blacklist
myurl.com,true

You can then use a lookup with this csv to output the blacklist find and then use it as a filter "blacklist=true".

As for other ways to accomplish that using the online blacklists with API keys, Splunk Enterprise doesn't have  functionality out of the box but Splunk Enterprise Security (SIEM) does have builtin functionality that allows you to setup downloads of threat intel like that and then have a correlation search to look for connections to threat IPs.
From docs: https://docs.splunk.com/Documentation/ES/7.0.0/Admin/Addthreatintel

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...