Getting Data In

How to use externbal blacklist/whitelist to filter syslog files?

splunkboob
Explorer

im trying to setup splunk to find suspicious traffic in incoming and outgoing traffic. right now im trying to exclude traffic that comes from places that are not suspicious (whitelist) like social media websites, news websites, internal traffic etc. and use a blacklists to trigger alerts if it tries to connect to my IP. im not sure where to start here, is this even possible in splunk? there are existing blacklists online that use an api key to connect to for that blacklist, can i use that api key in splunk? do i download an entire database and upload it under my C: drive? i really hope you guys can help me here

Labels (3)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

You can use lookups for that.
As an example:
with a csv with

url,blacklist
myurl.com,true

You can then use a lookup with this csv to output the blacklist find and then use it as a filter "blacklist=true".

As for other ways to accomplish that using the online blacklists with API keys, Splunk Enterprise doesn't have  functionality out of the box but Splunk Enterprise Security (SIEM) does have builtin functionality that allows you to setup downloads of threat intel like that and then have a correlation search to look for connections to threat IPs.
From docs: https://docs.splunk.com/Documentation/ES/7.0.0/Admin/Addthreatintel

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

diogofgm
SplunkTrust
SplunkTrust

You can use lookups for that.
As an example:
with a csv with

url,blacklist
myurl.com,true

You can then use a lookup with this csv to output the blacklist find and then use it as a filter "blacklist=true".

As for other ways to accomplish that using the online blacklists with API keys, Splunk Enterprise doesn't have  functionality out of the box but Splunk Enterprise Security (SIEM) does have builtin functionality that allows you to setup downloads of threat intel like that and then have a correlation search to look for connections to threat IPs.
From docs: https://docs.splunk.com/Documentation/ES/7.0.0/Admin/Addthreatintel

------------
Hope I was able to help you. If so, some karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...