Splunk Search

How to blacklist lookup for syslogs?

splunkboob
Explorer

I have a blacklist.csv file that looks like the following,

 

IP domain
1.0.136.29 # 2018-11-12, node-1lp.pool-1-0.dynamic.totbb.net, THA, 2
1.0.136.215 # 2018-10-06, node-1qv.pool-1-0.dynamic.totbb.net, THA, 2

 

i want to scan my syslog events and see if any IP address match the IPs in this blacklist.

a syslog event looks like this:

Feb 7 03:32:31 Router kernel: [WAN_IN-3009-A]IN=eth0 OUT=eth1.100 MAC=18:e8:29:44:40:ac:00:1d:aa:a2:78:axxxxxx src=128.199.123.0 DST=192.168.100.207 LEN=60 TOS=0x00 PREC=0x00 TTL=47 ID=52834 DF PROTO=TCP SPT=38290 DPT=8194 WINDOW=29200 RES=0x00 SYN URGP=0 MARK=0x64800000

i already set up a lookup definition and lookup table, but i dont know exactly how to put up a search to display if a syslog even matches an IP in the blacklist.csv

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming src and DST are already extracted and you don't already have a domain field extracted in your events, you could try this:

| lookup blacklist.csv IP as src
| lookup blacklist.csv IP as DST
| where isnotnull(domain)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Assuming src and DST are already extracted and you don't already have a domain field extracted in your events, you could try this:

| lookup blacklist.csv IP as src
| lookup blacklist.csv IP as DST
| where isnotnull(domain)
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...