Splunk Search

Is there a way to get a True or False match on source IP with Tor exit node list in a timechart?

kwhatcher
New Member

I would like to know if there is a way to get true/false match on source IP to see tor sourced traffic over time in a time chart.

0 Karma

andrew207
Path Finder

You can place the TOR exit node list into a CSV then at search time use an inputlookup like so:

index=firewall [|inputlookup torexitnodes.csv | fields exitnodeip ] 

Because Tor exit nodes change constantly you will probably need to have this CSV automatically updated by a script.

0 Karma

pavanbmishra
Path Finder

Thanks

Can you please suggest from where can we download the latest tor exit nodes IP details. Thanks in advance

0 Karma

garigis
Engager

If you haven't found a good place for tor exit nodes, http://iplists.firehol.org/ is a great resource.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...