Feedback
Got feedback? We want it! Submit your comments and suggestions for our community here.

Splunk_Ask

Naveen_4025
New Member

Hello, Team.
For the past 24 hours, we have received roughly 7-8 alerts indicating internal machines/hosts/NAT IPs connecting to IP Address: 34.117.186.192 which do belong to ipinfo.io website (where this IP belongs to Google Cloud and has been reported to be malicious on forums).

Splunk's proxy logs reveal frequently visited websites under the field "http_referrer" and under "values (url)" we see that , ipinfo/json*, ipinfo.io/?urls been displayed. Below are my asks:

1) What to "values(http_referrer) and "values (url)" repesent in Splunk Logs and Diff. b/w them in Investigations Checks.

2) Secondly, User visiting normal websites but why we are seeing always ipinfo/json*, ipinfo.io/?urls and such under "values (url)" field which are not browsed or accessed by users. (This was triggered on a rule mentioning Internal IP's connected multiple times to IP 34.117.186.192 and domain ipinfo.io.

Could you please clarify on the ask why was ipinfo been seen here when users were not accessing it? Thank you!

0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community!It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...