Splunk

Enrich searches with a lookup table of listed addresses and their scores.

Load the blocklist as a CSV lookup and enrich any search with the score, country and categories of the addresses in your logs.

Set it up

1. Download the lookup into an app's lookups folder from cron, hourly:

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=csv&confidenceMinimum=25&limit=500000" \
     -o $SPLUNK_HOME/etc/apps/search/lookups/isipsafe.csv

   The file has the columns ip, confidence, reports, reporters, last_reported, country, asn, categories.
2. Use it in a search, for example web traffic from listed addresses:

   index=web sourcetype=access_combined
   | lookup isipsafe.csv ip AS clientip OUTPUT confidence categories country
   | where confidence >= 75
   | stats count BY clientip confidence categories country

3. Optional: create a lookup definition in Settings › Lookups, and an automatic lookup on your sourcetype, so every event is enriched without the lookup command.

On Splunk Cloud, upload the file through Settings › Lookups › Lookup table files, or use an app that fetches it for you.

Need a hand?

If something here does not work with your version of Splunk, or you have improved it, tell us. We update these pages with what people send.

Splunk and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.