Enterprise Security connect to firewall and block IP addresses?

[johnny_goya]

Hi guys,

There is a way that i can automate block IP addresses in my firewall with a script?

Where can i put my script and how can i execute?

I was trying to use adaptive response, i'm in the right direction?

[tiagofbmm · Accepted solution]

Put the script on the bin directory of the app you have to wrap it, and create a custom adaptive response that will take it. Make sure Splunk will have permissions to execute such operations at OS level... which may no be possible

[tiagofbmm]

@johnny_goya please accept an answer if it solved/helped it and upvote it. Otherwise let us know how can we help further