Splunk Enterprise Security

Best practices for enhancing data on Notable Events via API calls

gabrieltomasett
Engager

Hello all,

I am trying to create a python script that pulls down information from a notable event in Enterprise Security. Then, passes that information (IP addresses, MD5s, and files) to third party APIs (such as VirusTotal or Palo Alto Wildfire) and references the hosts in an EDR tool (Crowd Strike or Carbon Black) collecting relevant information and sending that information back to the notable in Splunk.

I have most everything figured out except for putting the information back in Splunk. The closest thing I could find to what I want to do is adding a comment with the information:

url2 = 'https://SomeSplunkDomain.com:8089/services_update'
urgency = None
status = None
owner = None

event_id #taken from a dict
comment #taken from a dict

data = {
'ruleUIDs': [event_id],
'urgency': [urgency],
'status': [status],
'newOwner': [owner],
'comment': [comment]
}
notableUpdate = requests.post(url2, data=data, verify=False, auth=(someUsername, somePassword))
response2 = notableUpdate.json()
print(response2)

However, I could see a couple of issues arising from this and I am hoping someone knows a better way to add information to notable events. I don’t want to create another notable by adding the information to another correlation search.

Thank you in advance!

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Notable events are indexed summary events. There is no modifying an event once indexed in Splunk. You have two options.
1. If you want fields indexed in the notable event make your code a custom search command.
2. Make your code an adaptive response that indexes the data for subsequent searching, or populates a lookup that you shim onto the notable events.

See this for shimming on a lookup
http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/

View solution in original post

starcher
SplunkTrust
SplunkTrust

Notable events are indexed summary events. There is no modifying an event once indexed in Splunk. You have two options.
1. If you want fields indexed in the notable event make your code a custom search command.
2. Make your code an adaptive response that indexes the data for subsequent searching, or populates a lookup that you shim onto the notable events.

See this for shimming on a lookup
http://www.georgestarcher.com/splunk-enterprise-security-enhancing-incident-review/

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...