Splunk Search

Is there a way to get a True or False match on source IP with Tor exit node list in a timechart?

kwhatcher
New Member

I would like to know if there is a way to get true/false match on source IP to see tor sourced traffic over time in a time chart.

0 Karma

andrew207
Path Finder

You can place the TOR exit node list into a CSV then at search time use an inputlookup like so:

index=firewall [|inputlookup torexitnodes.csv | fields exitnodeip ] 

Because Tor exit nodes change constantly you will probably need to have this CSV automatically updated by a script.

0 Karma

pavanbmishra
Path Finder

Thanks

Can you please suggest from where can we download the latest tor exit nodes IP details. Thanks in advance

0 Karma

garigis
Engager

If you haven't found a good place for tor exit nodes, http://iplists.firehol.org/ is a great resource.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...