Splunk Search

How to use a CSV file of IP addresses and countries to set up an alert if an international IP is contacted on our network?

bcyates
Communicator

Our Splunk admin has recently moved on to a new position here so I am trying to fill the void until a replacement is brought on board. My admin experience with Splunk is limited (only what he turned over to me before he left.)

My goal here is to be able to setup an alert anytime that an international IP is contacted on our network. Whether it be a local user accessing a site that has an international IP or a malicious email attachment redirecting to an international IP.

I have a list of IPs and which Country they predominantly belong to on a CSV file. Has anyone done this and if so, what is the best way to go about doing it?

0 Karma

gfreitas
Builder

Hi bcyates,

The easiest way to do so is to use the command iplocation. This command generate a field called Country that show the country of the IP address automatically. You can do:

your search | iplocation dstip | search NOT Country = "country"

Hope this helps.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...