Splunk

What this gives you

A CSV of scored attacker IPs, refreshed on a schedule, available to every search as a lookup. Any event with a source address can then be annotated with a 0-100 hostility score, the country, the network and the number of times we have seen the address, without leaving Splunk.

Fetch the feed

Write the CSV into the lookups directory of an app you control. On a search head, a cron entry or a scripted input on the same schedule is enough: the feed changes on the order of hours, not seconds.

# /etc/cron.hourly/ctif-splunk
curl -fsS -H "X-CTIF-Key: $CTIF_API_KEY" \
  "https://ctif.orvteam.com/api/blocklist?format=csv&min_score=50&limit=50000" \
  -o /opt/splunk/etc/apps/search/lookups/ctif_blocklist.csv.tmp \
  && mv /opt/splunk/etc/apps/search/lookups/ctif_blocklist.csv.tmp \
        /opt/splunk/etc/apps/search/lookups/ctif_blocklist.csv

The columns are ip, hostility_score, country, sighting_count, last_seen, source. Download to a temporary name and rename, so a search never reads a half-written file.

Define the lookup

# $SPLUNK_HOME/etc/apps/search/local/transforms.conf
[ctif_blocklist]
filename = ctif_blocklist.csv
case_sensitive_match = false

Reload with a restart of the search head, or from Settings, Lookups, Lookup table files.

Enrich and alert

index=firewall action=allowed
| lookup ctif_blocklist ip AS src_ip OUTPUT hostility_score country sighting_count last_seen
| where hostility_score >= 70
| stats count values(country) AS country max(hostility_score) AS score BY src_ip
| sort - score

Save that as an alert to page on inbound connections from addresses our sensors scored 70 or above. Lower the threshold to see more, raise it to see only the strongest evidence; how the score is built is on the methodology page.

If you run Enterprise Security

The same CSV URL can be registered as a threat intelligence download in ES, so matches land in the threat activity dashboards rather than in your own searches. The URL and credentials are identical to the ones above. We have not published a stanza we have not tested in a customer ES instance; write to support and we will work through it with you rather than guess at your configuration.

Notes

Each fetch counts as one request against your daily quota, so an hourly pull costs 24 requests a day. Add first_party_only=true to the URL if you want only what our own sensors saw, without the public lists we import.