Splunk Search

How to blacklist lookup for syslogs?

splunkboob
Explorer

I have a blacklist.csv file that looks like the following,

 

IP domain
1.0.136.29 # 2018-11-12, node-1lp.pool-1-0.dynamic.totbb.net, THA, 2
1.0.136.215 # 2018-10-06, node-1qv.pool-1-0.dynamic.totbb.net, THA, 2

 

i want to scan my syslog events and see if any IP address match the IPs in this blacklist.

a syslog event looks like this:

Feb 7 03:32:31 Router kernel: [WAN_IN-3009-A]IN=eth0 OUT=eth1.100 MAC=18:e8:29:44:40:ac:00:1d:aa:a2:78:axxxxxx src=128.199.123.0 DST=192.168.100.207 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=52834 DF PROTO=TCP SPT=38290 DPT=8194 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0x64800000

i already set up a lookup definition and lookup table, but i dont know exactly how to put up a search to display if a syslog even matches an IP in the blacklist.csv

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming src and DST are already extracted and you don't already have a domain field extracted in your events, you could try this:

| lookup blacklist.csv IP as src
| lookup blacklist.csv IP as DST
| where isnotnull(domain)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming src and DST are already extracted and you don't already have a domain field extracted in your events, you could try this:

| lookup blacklist.csv IP as src
| lookup blacklist.csv IP as DST
| where isnotnull(domain)
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...