How to use a list of allowable IP addresses?

[kevinb0011]

Good morning,

Curious to see if anyone has used a similar dataset in Splunk and/or any suggestions on the best way to create a usable solution.

I have a list of IP addresses, and for each IP address there is a list of allowable systems (IPs) . If any of the IP addresses communicate with systems outside of the allowable list I want to be alerted. I know I can probably create individual alerts for each of these but would like to be able to process these in bulk. For example, if Splunk could periodically cross reference the IP list against the network data to see if there are any violations. Could a lookup table be used for this?

[gcusello · Accepted solution]

Hi @kevinb0011,

you can use a lookup (called e.g. your_lookup.csv) to store the allowed IPs and then run a search:

at first you have to define the fields containing IP to monitor and then run something like this:

index=* 
| eval ip=coalesce(src,src_ip.dest, dst,dest_ip,dst_ip)
| search NOY [ | inputlookup your_lookup.csv | fields ip ]

in this way list all the IP in the choosen fields not listed in the lookup.

Ciao.

Giuseppe

[kevinb0011]

Great thank you for the quick response. I'm going to try this out asap.

Curious as to how much this complicates things, but what if the allow list is unique per IP.  So each IP could have similar or different allowed communicants. Could this be captured in one lookup table?

For example:

Main IP List            Allowed IPs

10.0.0.1                   (10.1.0.0, 10.2.00, 10.3.00)

10.0.0.2                   (10.0.1.0, 10.0.2.0)

10.0.0.3                   (192.168.1.1, 10.1.0.0)

[gcusello]

Hi @kevinb0011,

in the allow list you can use asterisk (10.1.0.*) or subnets (10.1.0.0/24).

The main problem, is to identify all the fields that could contain ip addresses and put them in the coalesce command.

Ciao.

Giuseppe

[kevinb0011]

ok great thanks

[gcusello]

Hi @kevinb0011,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉