Bogon list

mmoermans · ‎11-13-2018

Hi,

In ES there is a bogonlist included with subnet masks for bogus ip ranges. How is this used standard in Splunk ES and how could you search these subnets against the network traffic datamodel?

richgalloway · ‎09-10-2019

See the "Unroutable Activity Detected" correlation search for an example of how to use the bogonlist lookup file.

---
If this reply helps you, Karma would be appreciated.

Bogon list

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Bogon list

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future