Security

ISP of blocked IP address

ephrem3232
Explorer

Splunk Query for adding a column for ISP of blocked IP address? 

 

Thank you,

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
I understand you want to map an IP address to the Internet Service Provider that owns that address. Is that correct? If so, do you have such a mapping available in your Splunk system? Do you have access to a service that can perform such a mapping?
---
If this reply helps you, Karma would be appreciated.
0 Karma

ephrem3232
Explorer

Yes, I want to find the organization/ ISP of the IP addresses I have on my table. Yes I can create a mapping on my splunk server.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
So you have the data you need. What is the problem you are trying to solve?
---
If this reply helps you, Karma would be appreciated.
0 Karma

ephrem3232
Explorer

I'm trying to include in my query of IP address that I have listed on a table to also display the ISP/ Organization  of the IP addresses. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the easiest way to do that is by using a lookup table.  You will need to put your ISP mapping data into a CSV file so it looks something like this.

Address, ISP
1.2.0.0/16, xyz.net
2.3.0.0/16, wxy.net

Create a lookup definition (Settings->Lookups->Lookup Definitions) that references this file.  In the "Match type" field enter "CIDR(Address)".

In your search query, add the lookup command to map address to ISP.

<your search> | lookup ISPs address as ip_address OUTPUT ISP
| table ip_address, ISP
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...