Splunk as IPS

[vmicovic2]

Hi all,

is there case where someone setup splunk as IPS maybe?

For example, on alert X trigger script which will take from alert IP/MAC and same script will block or change VLAN police of that IP/MAC on ASA for example?

thank you

[vmicovic2]

ok, does community edition include isolation ?

i need only that option, wont buy whole product for one thing..

[richgalloway]

That sounds like the kind of use case for which Splunk has Phantom.

[hevertonkleidso]

I would say the same.

[hevertonkleidso]

But you don't need to buy a new product. You can use the free version and create some python scripts by your self.

[vmicovic2]

amm.. in that case will create same script which will be triggered on alert X. Don`t need to add another service for simple task..

i was just asking for some experience regarding to subject...