Splunk Search

IP Watchlist Lookup

nlisle
New Member

Hello,

I currently have a search against our firewalls, below is the current search.

index=(my index) sourcetype="my_source" ipsrcip!=(ip)

I have a lookup file called 'threatip' that contains a list of source IP's in the first column named 'ip'. I would like to create a search that presents events from the initial search where the source IP from the lookup matches the source IP in the firewall logs.

Firewall log fields -

Source IP - 'srcip'

Lookup Table Fields -

Source IP - 'ip'

It seems so simple yet I am having some issues with it, advice would be much appreciated.

Thank you,
Nick.

0 Karma

jbillings
SplunkTrust
SplunkTrust

Try this
index=(my index) sourcetype="my_source" |search [|inputlookup threatip.csv | fields ip |rename ip as srcip]

0 Karma

woodcock
Esteemed Legend

Like this:

index="myIndex" AND sourcetype="my_source" AND ipsrcip!=(ip) AND [|inputlookup MyLookupFile.csv | rename ip as srcip | table srcip]

OR

index="myIndex" AND sourcetype="my_source" AND ipsrcip!=(ip)
| lookup MyLookupFile.csv ip AS srcip OUTPUT ip AS MATCHED
| where isnotnull(MATCHED)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nlisle,
please try something like this:

index=my index sourcetype="my_source" [ | inputlookup threatip | rename ip AS srcip | fields srcip ]
| ...

Ciao.
Giuseppe

0 Karma

nlisle
New Member

Hi Giuseppe, I have tried this search however I receive no results. I can confirm that I have already added some data into the lookup, IP's that have hit the firewall in the past 30 days. I am also running my search over the last 30 days. Thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...