Splunk Enterprise Security

Can anyone recommend a relevant public malware domain list?

AlexeySh
Communicator

Hello,

I find that the default malware domain list used by Splunk ES (that of malwaredomains.com) is not very relevant: it contains a lot of business services, new sites, etc., so ES generates a lot of false positives.

I’d like to know if anyone has experience of using any other public malware domain lists and/or if there are some you could recommend.

Thanks for the help.

Regards,
Alexey.

0 Karma

kchamplin_splun
Splunk Employee
Splunk Employee

Hello @AlexeySh - while I don't have any recommendations for free malware domain lists (hopefully others will chime in). That said, do you have some examples of false positives that are on the list that are showing up?

0 Karma

AlexeySh
Communicator

Hello @kchamplin [Splunk],

Sure, here is some detection we had recently:

widoobiz.com – broadcast Media
mon-poeme.fr – leisure website
mlsend.com – business communication
safelinks.protection.outlook.com – webmail
gandi.net – domain name management

Fortunately, we do not have a huge volume of false positives, but still there is always some legitimate websites detected every week including a new ones so it’s kind of hard to whitelist.

Regards,
Alexey.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...