Could you kindly assist me?

[KingUs80]

I'm looking to craft a query  (a correlation search) that would trigger an alert in the event that an internal system tries to access a malicious website. I would greatly appreciate any suggestions you may have. Thank you in advance for your help.

Source=bluecoat

[gcusello]

Hi @KingUs80 ,

see in the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435), or, if you already have, in Enterprise Security Premium App.

The feature in ES is Threat Intelligence: you must have an internal list of malicious sites of a list downloaded from free or payment services.

Other apps that you could use are MISP42 (https://splunkbase.splunk.com/app/4335) or https://splunkbase.splunk.com/apps?keyword=threat+intelligence 

Ciao.

Giuseppe