Splunk Search

Add priority to systems and setup alerts for critical systems

spj2
New Member

Hi,

I am trying to find automatic way of adding asset priority (Critical, High etc.) based on IP address and/or hostname in the Splunk Enterprise app so that I can setup alerts and prioritize investigations on these. I know that Splunk PCI Compliance app does that but we don't have it. I have searched the forum too, but haven't found anything.

Does anyone know of a way to achieve this?

Thanks in advance.

SPJ

Tags (1)
0 Karma

spj2
New Member

Thanks it works with a slight modification:

yoursearchhere
| lookup assetLookup assetId as src_ip OUTPUT priority
| stats count by priority

yoursearchhere
| lookup assetLookup assetId as host OUTPUT priority
| where priority="High" OR priority="Critical"

0 Karma

lguinn2
Legend

I suggest using a lookup table. Your CSV file might look like this

AssetList.csv

assetId,priority
192.168.15.22,Medium
fileserver01,Low

Here is the Splunk tutorial Use field lookups In my examples below, I assume that you have uploaded the AssetList.csv file and created a lookup called assetLookup.

Ultimately, you should be able to do something like this:

yoursearchhere
| lookup assetLookup src_ip as assetId OUTPUT priority
| stats count by priority

yoursearchhere
| lookup assetLookup host as assetId OUTPUT priority
| where priority="High" OR priority="Critical"
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...