Alerting

How can I set up a watchlist?

Dan
Splunk Employee
Splunk Employee

We have a list of domains in a watchlist and want to generate an alert when they show up in DNS queries.

How would I go about doing this in Splunk?

Tags (2)
1 Solution

ftk
Motivator

Both approaches posted here by Dan and muebel will work. Choosing one depends on how many domains you want to alert on as well as how you wish to maintain the list of bad domains.

If there are just a few domains, go ahead and tag the domains as per muebel's example and schedule a saved search for the tag and enable alerting: http://www.splunk.com/base/Documentation/4.1.3/AppManagement/Createanalert

If you have a large number of domains, or the list of domains to alert on changes frequently, follow Dan's example. Create a csv with the list of domains and have your search do a lookup on it: http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources Finally, schedule your search and alert on it: http://www.splunk.com/base/Documentation/4.1.3/AppManagement/Createanalert

The advantage of the csv approach is that you can have anybody update the domain filter csv without needing to have special knowledge about splunk. This will appease your PHBs and make your life easier 🙂

View solution in original post

nuro
New Member

I got the concept of creating the new field.. What if i need to have a partial match on any field with a list of malicious domains.. for example the splunk field contains xxxy.com and my list contains xxxy only... how "contains" or "like" can be implemented.

0 Karma

ftk
Motivator

Both approaches posted here by Dan and muebel will work. Choosing one depends on how many domains you want to alert on as well as how you wish to maintain the list of bad domains.

If there are just a few domains, go ahead and tag the domains as per muebel's example and schedule a saved search for the tag and enable alerting: http://www.splunk.com/base/Documentation/4.1.3/AppManagement/Createanalert

If you have a large number of domains, or the list of domains to alert on changes frequently, follow Dan's example. Create a csv with the list of domains and have your search do a lookup on it: http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources Finally, schedule your search and alert on it: http://www.splunk.com/base/Documentation/4.1.3/AppManagement/Createanalert

The advantage of the csv approach is that you can have anybody update the domain filter csv without needing to have special knowledge about splunk. This will appease your PHBs and make your life easier 🙂

muebel
SplunkTrust
SplunkTrust

You could also tag the domain:

### In tags.conf

[domain="bad.domain.etc"]
suspicious_domain = enabled

Then run a scheduled search on tag=suspicious_domain which you could alert on for events found > 0

Dan
Splunk Employee
Splunk Employee

You would use a lookup table. Just dump a csv with two columns - a domain column and a "suspicious" column that is always set to 1. The lookup would enrich raw events with an extra "suspicious" field, and you would just search for "sourcetype=dns suspicious=1". Anytime the watchlist changes, you just overwrite the csv table and any new queries would pick up the latest mappings.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...