Splunk Search

How to create a query to identify blocked IP's by firewall and the reason?

k115
Engager

Hi, I am working with firewall logs in external IP's ,  I want to collect blocked IP's from the firewall, and blocked reason mean, why is the firewall blocked this external IP,  so wanna create a query to identify blocked IP's by firewall and the reason , signature of the firewall rule, please help me into this, the tstat  could be useful.

 

 

Labels (4)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

For others to be helpful, you always want to post sample data (anonymize as needed), and explain or better, illustrate (via mockup and other means) the results you want out of.  Even better would be to post SPL you have tried and the output, explain how the output does not meet your requirement; or post pseudo code to help others understand your requirements.

For tstats to work, there are other requirements.  So, it is even more important to illustrate data, and explain how raw logs are indexed.  Remember, this is a Splunk forum, not a firewall forum.

0 Karma

k115
Engager

HI yuanliu,

Thanks for the update me, usually I want to lookup the what are the external IP addresses blocked by firewall, so I usually run this query:

index=* sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="imperva:waf" action=blocked (src!=x.x.x.x AND src!=x.x.x.x/18) | stats count by src, dest, sourcetype, action | table src, dest, sourcetype, action

so, I wanna upgrade this query or another query to see,  why is this IP blocked by firewall, its could be bruteforce, any other threat, web related attack and so on, from above query I can see the field called description, but its not useful, so wanna any ideas or queries.

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I have a feeling that you are asking in the wrong forum.  If the data don't contain information whether the action is taken due to bruteforce, any other threat, web related attack and so on, how do you expect Splunk to magically come up with an answer?  If anything, you should ask the vendors/developers who provide sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="imperva:waf".

One possible venue to investigate within Splunk is to question whether all these three sourcetypes use the same field name "action" and value "blocked" to signify the blocking action?  If they each use a different field or different value (or different both), your base search would be missing some data that may help.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...