Splunk Enterprise Security

How can I add Spamhaus Datasets for Splunk?



hello sir 

How i  add  spamhaus dataset in splunk ,??? 

any guide or process?? please help  

i already installed Spamhaus Datasets for Splunk,

0 Karma


There are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.
Have the application send data directly to Splunk using HTTP Event Collector (HEC).

The Spamhaus app provides searches for data that is already in Splunk.  So it's up to you to get the data into your indexers.  Per the app's splunkbase page: "To utilize this data customers must be subscribed to the Spamhaus Data Query Service (DQS). This service is FREE for low-volume users, simply complete the sign-up form at: https://www.spamhaustech.com/free-trial/sign-up-for-a-free-data-query-service-account/"

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...