Installation

Reduce specific logging

mmoermans
Path Finder

When there's a huge influx of incoming logging of blocked attempts on the firewall from one specific (external) source, is it possible to (temporarily) decrease/disable the amount of logging being received from this specific source so it doesn't flood our license when it's a known issue?

Thanks in advance for the response

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Why don't you manually null-route the attacking host's IP on the attacked device so it can no longer attempt to connect? Then the failed logins do not happen. For that matter, why is this kind of mitigation not automatically in place in your network (e.g. fail2ban or whatever)? Remove it when the proper configuration is in place.

https://en.wikipedia.org/wiki/Null_route
P.S. I know that this is not an "attack".

View solution in original post

0 Karma

woodcock
Esteemed Legend

Why don't you manually null-route the attacking host's IP on the attacked device so it can no longer attempt to connect? Then the failed logins do not happen. For that matter, why is this kind of mitigation not automatically in place in your network (e.g. fail2ban or whatever)? Remove it when the proper configuration is in place.

https://en.wikipedia.org/wiki/Null_route
P.S. I know that this is not an "attack".

0 Karma

woodcock
Esteemed Legend

Thesplunky way to do this now is with Phantom-based automation.

0 Karma

woodcock
Esteemed Legend

The only practical way is to stop splunk on that forwarder (host).

0 Karma

adonio
Ultra Champion

hello there,
i am not aware of anything "out of the box" that splunk has for that situation, if there is, would love to learn about it.
With that being said, one thing i can think of is setting an alert on your condition,
add trigger a script to that alert and have the script writing props and transforms that sending the unwanted data to nullqueue. Challenge here is how you reset back to your original configurations. maybe the script will also have a timer to reset after X amount of time.
there are other challenges with that approach, specially if this is a clustered environment.
hope it slightly helps

0 Karma

gcusello
Esteemed Legend

Hi mmoermans,
it's possible to create a filter but the problem is that you have to restart Splunk to enable it.
At this point it's easier to stop log forwarding from your firewall and restart it after the tempest.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...