Installation

Reduce specific logging

mmoermans
Path Finder

When there's a huge influx of incoming logging of blocked attempts on the firewall from one specific (external) source, is it possible to (temporarily) decrease/disable the amount of logging being received from this specific source so it doesn't flood our license when it's a known issue?

Thanks in advance for the response

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Why don't you manually null-route the attacking host's IP on the attacked device so it can no longer attempt to connect? Then the failed logins do not happen. For that matter, why is this kind of mitigation not automatically in place in your network (e.g. fail2ban or whatever)? Remove it when the proper configuration is in place.

https://en.wikipedia.org/wiki/Null_route
P.S. I know that this is not an "attack".

View solution in original post

0 Karma

woodcock
Esteemed Legend

Why don't you manually null-route the attacking host's IP on the attacked device so it can no longer attempt to connect? Then the failed logins do not happen. For that matter, why is this kind of mitigation not automatically in place in your network (e.g. fail2ban or whatever)? Remove it when the proper configuration is in place.

https://en.wikipedia.org/wiki/Null_route
P.S. I know that this is not an "attack".

0 Karma

woodcock
Esteemed Legend

Thesplunky way to do this now is with Phantom-based automation.

0 Karma

woodcock
Esteemed Legend

The only practical way is to stop splunk on that forwarder (host).

0 Karma

adonio
Ultra Champion

hello there,
i am not aware of anything "out of the box" that splunk has for that situation, if there is, would love to learn about it.
With that being said, one thing i can think of is setting an alert on your condition,
add trigger a script to that alert and have the script writing props and transforms that sending the unwanted data to nullqueue. Challenge here is how you reset back to your original configurations. maybe the script will also have a timer to reset after X amount of time.
there are other challenges with that approach, specially if this is a clustered environment.
hope it slightly helps

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi mmoermans,
it's possible to create a filter but the problem is that you have to restart Splunk to enable it.
At this point it's easier to stop log forwarding from your firewall and restart it after the tempest.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...