Logstash

Add scores to events with the translate filter, or live lookups with the http filter.

Add the isipsafe score to events as they pass through Logstash, so every downstream search and dashboard can filter on it. For busy pipelines, use a local dictionary; for low volumes, live lookups work too.

Fast: a local dictionary

1. Download the list hourly as a two-column file (address, confidence):

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=csv&confidenceMinimum=25&limit=500000" \
     | awk -F, 'NR>1 {print $1","$2}' > /etc/logstash/isipsafe.csv.new && mv /etc/logstash/isipsafe.csv.new /etc/logstash/isipsafe.csv

2. Translate the source address in your pipeline; the file is re-read every hour:

   filter {
     if [source][ip] {
       translate {
         source           => "[source][ip]"
         target           => "[threat][isipsafe][score]"
         dictionary_path  => "/etc/logstash/isipsafe.csv"
         refresh_interval => 3600
       }
     }
   }

   Older versions of the translate plugin call these options field and destination.

Live: the http filter

For low-volume pipelines where you want the full, current record (reports, categories, network), call the API per event with the http filter:

filter {
  if [source][ip] {
    http {
      url         => "https://isipsafe.com/api/v1/check"
      verb        => "GET"
      query       => { "ip" => "%{[source][ip]}" }
      headers     => { "Authorization" => "Bearer ${ISIPSAFE_KEY}" }
      target_body => "[threat][isipsafe]"
    }
  }
}

Every event is one lookup against your daily allowance, so put a filter in front (only failed logins, only external addresses).

Need a hand?

If something here does not work with your version of Logstash, or you have improved it, tell us. We update these pages with what people send.

Logstash and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.