Bogon list

mmoermans · ‎11-13-2018

Hi,

In ES there is a bogonlist included with subnet masks for bogus ip ranges. How is this used standard in Splunk ES and how could you search these subnets against the network traffic datamodel?

richgalloway · ‎09-10-2019

See the "Unroutable Activity Detected" correlation search for an example of how to use the bogonlist lookup file.

---
If this reply helps you, Karma would be appreciated.

Bogon list

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation

Bogon list

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security