Splunk Enterprise Security

How to pass data to an external api

dkloud
Explorer

Hi,

I am using a 3rd party tool to get information about different indicators of compromise (eg: domains).
I am getting data from that tool through a rest API.

What I'm trying to do is to enrich the events from our proxy server, with the information provided by this API.

index=proxy category="Malware" 
| join domain type=left [| rest splunk_server=local /services/3rdpartytool/lookup_domain/$domain$ fields="entity,risk" | rename entity.name as domain]
| table domain, src_ip, risk.score

Where it fails is when passing the $domain$ variable to the rest subsearch:
Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/3rdpartytool/lookup_domain/$domain$

I tried the other way around, with the same result:

| rest splunk_server=local /services/3rdpartytool/lookup_domain/$domain$ fields="entity,risk"
| rename entity.name as domain
| join domain [search index=proxy category="Malware"]
| table table domain, src_ip, risk.score

domain and src_ip are returned by the index=proxy... search while risk.score is returned by the rest search.

So, the way I want this to work is:
if a user accessed a domain categorized as Malware by the proxy server
then attach the risk.score for the respective domain provided by the 3rd party tool

Any idea on how to achieve this?

Thank you.

0 Karma

dkloud
Explorer

Finally, I got it right, the search below does what I need:

index=proxy category="malware"
| map maxsearches=15 search="mymacro($query$)"
| join type=left query
[search index=proxy category="malware"
| stats count by src_ip, query, risk.score

the macro:
rest splunk_server=local /services/3rdpartyapp/lookup_domain/$domain$ fields="entity,risk" | rename entity.name as query

0 Karma

dkloud
Explorer

I also tried using a macro that is executing the rest search, with the domain as argument.
However, when executing the main search and call for the macro, it's the field name (query) that gets passed to the macro instead of the field value (somedomain./com)

index=proxy category="malware"
| join query type=left
[| my_macro(query)]
| stats count by src_ip, query, risk.score

the macro looks like:
rest splunk_server=local /services/3rdpartyapp/lookup_domain/$domain$ fields="entity,risk" | rename entity.name as query

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...