Best Method of Associating External IP with a Description

[luongg]

Hi,

I'm not exactly sure what is the best way to approach this issue. I have a list of external IP address along with descriptive names for each of those IP addresses. I want to make it so that all Splunk Enterprise Security dashboards show that descriptive name every time one of those known external IP addresses appear. What is the best way to associate each name to each of my known external IP addresses?

Example:
My external IP = 54.123.123.123
My descriptive name = MyExternalMailServer

Thanks,
Grant L

[pablo_sanchez]

use a lookup table. (csv file)
Add all your data into a file called .csv
The file will content something along these lines:

IP, description
54.123.123.123, MyExternalMailServer

then you can call it using the inputlookup command.

| inputlookup filename.csv

You can create your alert based on this file. You can even populate this file automatically from a saved search using the ouputlookup command to do it.

Thanks,

[PavelP]

Hello @luongg,

you can use lookup table with two columns: ip,ip_desc

ip,ip_desc
54.123.123.123,MyExternalMailServer

then you can use a lookup command or configure automatic lookup to get ip_desc value depending of ip.

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Aboutlookupsandfieldactions