Splunk Search

Is there a way to get a True or False match on source IP with Tor exit node list in a timechart?

kwhatcher
New Member

I would like to know if there is a way to get true/false match on source IP to see tor sourced traffic over time in a time chart.

0 Karma

andrew207
Path Finder

You can place the TOR exit node list into a CSV then at search time use an inputlookup like so:

index=firewall [|inputlookup torexitnodes.csv | fields exitnodeip ] 

Because Tor exit nodes change constantly you will probably need to have this CSV automatically updated by a script.

0 Karma

pavanbmishra
Path Finder

Thanks

Can you please suggest from where can we download the latest tor exit nodes IP details. Thanks in advance

0 Karma

garigis
Engager

If you haven't found a good place for tor exit nodes, http://iplists.firehol.org/ is a great resource.

Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...