Splunk Enterprise Security

How to use a certain field as IP to correlate with Splunk Enterprise Security threat intelligence sources?

andresito123
Communicator

I have included in my installation Sophos Virtual Email Appliance logs. The logs include the originating IP with field name "fur". Is there any way to map it as IP in order to get correlated with Enterprise Security app threat intelligence sources (e.g. if this IP is flagged by enterprise security, etc.)?

Thanks!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi andresito123,

You're not looking for map (this is a search command which should be only used as some sort of last resort).
You're looking for a field alias http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Abouttagsandaliases

By using an alias of IP for fur you will able to use it in Enterprise Security.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi andresito123,

You're not looking for map (this is a search command which should be only used as some sort of last resort).
You're looking for a field alias http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Abouttagsandaliases

By using an alias of IP for fur you will able to use it in Enterprise Security.

Hope this helps ...

cheers, MuS

andresito123
Communicator

After this field alias, is there any extra work to be performed on the Enterprise security app?

0 Karma

MuS
SplunkTrust
SplunkTrust

Take a look at the docs about the CIM http://docs.splunk.com/Documentation/CIM/4.4.0/User/NetworkTraffic and find the matching field name for your fur and ES will pick it up on its own.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...