Splunk Enterprise Security

Best practices for enhancing data on Notable Events via API calls

gabrieltomasett
Engager

Hello all,

I am trying to create a python script that pulls down information from a notable event in Enterprise Security. Then, passes that information (IP addresses, MD5s, and files) to third party APIs (such as VirusTotal or Palo Alto Wildfire) and references the hosts in an EDR tool (Crowd Strike or Carbon Black) collecting relevant information and sending that information back to the notable in Splunk.

I have most everything figured out except for putting the information back in Splunk. The closest thing I could find to what I want to do is adding a comment with the information:

url2 = 'https://SomeSplunkDomain.com:8089/services_update'
urgency = None
status = None
owner = None

event_id #taken from a dict
comment #taken from a dict

data = {
'ruleUIDs': [event_id],
'urgency': [urgency],
'status': [status],
'newOwner': [owner],
'comment': [comment]
}
notableUpdate = requests.post(url2, data=data, verify=False, auth=(someUsername, somePassword))
response2 = notableUpdate.json()
print(response2)

However, I could see a couple of issues arising from this and I am hoping someone knows a better way to add information to notable events. I don’t want to create another notable by adding the information to another correlation search.

Thank you in advance!

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Notable events are indexed summary events. There is no modifying an event once indexed in Splunk. You have two options.
1. If you want fields indexed in the notable event make your code a custom search command.
2. Make your code an adaptive response that indexes the data for subsequent searching, or populates a lookup that you shim onto the notable events.

See this for shimming on a lookup
http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/

View solution in original post

starcher
SplunkTrust
SplunkTrust

Notable events are indexed summary events. There is no modifying an event once indexed in Splunk. You have two options.
1. If you want fields indexed in the notable event make your code a custom search command.
2. Make your code an adaptive response that indexes the data for subsequent searching, or populates a lookup that you shim onto the notable events.

See this for shimming on a lookup
http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...