IOC threat hunting

[mackey]

We deal with hundreds of iocs ( mostly flagged IP's) that come in monthly, and we need to check them for hits in our network. We do not want to continue using summary search one at a time. Is it possible to use lookup table ( or any other way) to search hundreds at a time or does this have to be done one at a time. I am very new to splunk and still learning. I am needing to see if we have had any traffic from these or to these IP's. 

[Bhumi]

Hi @mackey 

Is your Org using Enterprise Security of Splunk?

[mackey]

I have access to ES yes. 

[Bhumi]

Hi @mackey 

If you have ES, it has a framework called "THREAT INTELLIGENCE" for managing threat feeds, detecting threats, and sending alerts. You should explore this functionality, as it can be quite beneficial. Additionally, there are several other high-quality sources of threat data available in that  which just need to be activated if required OR if you have your own custom feeds, you can also integrate them as custom lookups in threat intelligence.

As mentioned by @gcusello you have two options , explore it as per your requirement. 

For more info on this , please refer the below docs: 

https://lantern.splunk.com/Security/UCE/Guided_Insights/Threat_intelligence/Using_threat_intelligenc...

https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/threatintelligenceframework/

https://www.splunk.com/en_us/pdfs/feature-brief/splunk-threat-intelligence-management.pdf

If this helps, accept the answer by upvoting !!

Happy Splunking !!

[gcusello]

Hi @mackey ,

if you have these IOCs in a lookup table you can run a very simple search:

if your lookup is called my_ioc.csv and the ip list is in a column alled ip, you could run:

index=* [ | inputlookup my_ioc.csv | rename ip AS query | fields query ]

in this way you execute a search for all the ips listed in your lookup in full text search on all your events.

If instead you want to search these ips in pre-defined fields, you have only to change the field name in the subsearch, es. if you want to search in the src field, you could run:

index=* [ | inputlookup my_ioc.csv | rename ip AS src | fields src ]

Ciao.

Giuseppe

[gcusello]

Hi @mackey ,

this solution is if you don't have Enterprise Security.

If you have ES, you can add your IOC list to the threat intelligence lookups.

Ciao.

Giuseppe