How to create a query to identify blocked IP's by firewall and the reason?

[k115]

Hi, I am working with firewall logs in external IP's ,  I want to collect blocked IP's from the firewall, and blocked reason mean, why is the firewall blocked this external IP,  so wanna create a query to identify blocked IP's by firewall and the reason , signature of the firewall rule, please help me into this, the tstat  could be useful.

[yuanliu]

For others to be helpful, you always want to post sample data (anonymize as needed), and explain or better, illustrate (via mockup and other means) the results you want out of.  Even better would be to post SPL you have tried and the output, explain how the output does not meet your requirement; or post pseudo code to help others understand your requirements.

For tstats to work, there are other requirements.  So, it is even more important to illustrate data, and explain how raw logs are indexed.  Remember, this is a Splunk forum, not a firewall forum.

[k115]

HI yuanliu,

Thanks for the update me, usually I want to lookup the what are the external IP addresses blocked by firewall, so I usually run this query:

index=* sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="imperva:waf" action=blocked (src!=x.x.x.x AND src!=x.x.x.x/18) | stats count by src, dest, sourcetype, action | table src, dest, sourcetype, action

so, I wanna upgrade this query or another query to see,  why is this IP blocked by firewall, its could be bruteforce, any other threat, web related attack and so on, from above query I can see the field called description, but its not useful, so wanna any ideas or queries.

[yuanliu]

I have a feeling that you are asking in the wrong forum.  If the data don't contain information whether the action is taken due to bruteforce, any other threat, web related attack and so on, how do you expect Splunk to magically come up with an answer?  If anything, you should ask the vendors/developers who provide sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="imperva:waf".

One possible venue to investigate within Splunk is to question whether all these three sourcetypes use the same field name "action" and value "blocked" to signify the blocking action?  If they each use a different field or different value (or different both), your base search would be missing some data that may help.