Splunk Enterprise Security

In threatlists can you have multiple values in url?

mcronkrite
Splunk Employee
Splunk Employee

Can you have multiple domain names on single url field? Or does every row have to have single domain name?

0 Karma
1 Solution

jervin_splunk
Splunk Employee
Splunk Employee

The previous answer is incorrect; threatlists do not accept a pipe-delimited field as input for the "url" or "domain" fields. This is something that can easily be tested by simply trying it out. Place an entry into local_threatlist_domains.csv and wait for the threatlist management system to merge the CSVs into the active lookup tables:

$ cat local_threatlist_domains.csv
description,domain
        
test,splunk.com|google.com
        

    ... wait for a while ...
        

$ grep splunk threatlist_by_domain_or_url.csv
    
splunk.com|google.com,,,test,,splunk.com|google.com,,local_threatlist_domains,threatlist_domain

Note that the output CSV does not contain multiple entries as would be required in a lookup table for matching to work properly, but retains the pipe-delimited format; thus this indicates that this is not currently supported.

We'll coordinate to have the documentation corrected.

View solution in original post

mcronkrite
Splunk Employee
Splunk Employee

For URLs it would be good to split the url into parts. The URL can be main domain, but also has embedded cookie, referrer, etc. The threat list should be matching against all of its value within url field

0 Karma

mcronkrite
Splunk Employee
Splunk Employee

I've filed a case to request this feature.

0 Karma

jervin_splunk
Splunk Employee
Splunk Employee

The previous answer is incorrect; threatlists do not accept a pipe-delimited field as input for the "url" or "domain" fields. This is something that can easily be tested by simply trying it out. Place an entry into local_threatlist_domains.csv and wait for the threatlist management system to merge the CSVs into the active lookup tables:

$ cat local_threatlist_domains.csv
description,domain
        
test,splunk.com|google.com
        

    ... wait for a while ...
        

$ grep splunk threatlist_by_domain_or_url.csv
    
splunk.com|google.com,,,test,,splunk.com|google.com,,local_threatlist_domains,threatlist_domain

Note that the output CSV does not contain multiple entries as would be required in a lookup table for matching to work properly, but retains the pipe-delimited format; thus this indicates that this is not currently supported.

We'll coordinate to have the documentation corrected.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

You can separate multivalues with a pipe as a delimter, per the documentation. However, the way ES hashes out the threatlists url values, it's probably most efficient to have multiple values broken out..

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!