Splunk Enterprise Security

How do I search from a lookup to find if a URL contains a malicious domain?

anil_ec21
Explorer

Dear Splunk Experts,

I have very little experience on Splunk, need your help with my search.

I have a lookup with list of malicious domains and URLs. I need to get alerted if accessed URL contains any of the domains or URL's in lookup.

My below search isn't working!

index=paloalto
|search [inputlookup domains.csv | fields url ]
Maybe this will match only when URL is the same as in the list. Please help!
Also, we have datamodel related 'networktraffic' and 'paloalto'.. But I don't know how to use them 😞

Regards,
Anil A

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @anil_ec21,
try something like this:

index=paloalto [ | inputlookup domains.csv | rename url  AS query | fields query ]
| ...

In this way you run a full text search on the index using all the records of the lookup url field.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @anil_ec21,
try something like this:

index=paloalto [ | inputlookup domains.csv | rename url  AS query | fields query ]
| ...

In this way you run a full text search on the index using all the records of the lookup url field.

Ciao.
Giuseppe

0 Karma

anil_ec21
Explorer

Thank you very much for quick reply! It worked 🙂

0 Karma

anil_ec21
Explorer

My lookup csv file contains as below --
IOC
xyz.com
1.2.3.4.com/something
www.abc.com/page

and so on..!

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...