Splunk Search

Using lookup table with host-ip association

User2
Engager

Hi, I would like to ask a question regarding the lookups table.

I am managing logs about login and I want to be sure that on a specific host you can access only with a specific IP address, otherwise alert is triggered.

So basically I have a lookup built like this

IPHOST
1.1.1.1host1
2.2.2.2host2
3.3.3.3host3

My purpose is to build a query search that finds whenever the IP-HOST association is not respected.

1.1.1.1 connects to host1 ---> OK

1.1.1.1 connects to host2 ---> BAD

2.2.2.2 connects to host1 ---> BAD

The connection from host1 should arrive only from 1.1.1.1, etc..

How can I text this query? 

Thank you

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Just do a lookup using both fields (source IP and destination host) and output one of those fields as a new field.

Something like

| lookup allowed_ips IP AS src_ip HOST as dst_host OUTPUT HOST AS matchhost

This will create a field called matchhost which will be populated only if both src_ip and dst_host in your event match one of the entries from your lookup.
You can now search for the events matching or not matching your criteria by verifying if matchhost is null or not.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just do a lookup using both fields (source IP and destination host) and output one of those fields as a new field.

Something like

| lookup allowed_ips IP AS src_ip HOST as dst_host OUTPUT HOST AS matchhost

This will create a field called matchhost which will be populated only if both src_ip and dst_host in your event match one of the entries from your lookup.
You can now search for the events matching or not matching your criteria by verifying if matchhost is null or not.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...