icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Passive SSL
SHA256 checksum (passive-ssl_10.tgz) 04dd557147cf57d0cf495513c5a5e2c0eadde283164363fd5cb1f8a75c653a84
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

Passive SSL

This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
CIRCL Passive SSL is a database storing historical X.509 certificates seen per IP address. The Passive SSL historical data is indexed per IP address, which makes it searchable for incident handlers, security analysts or researchers.

This is a scripted lookup to query this database directly from Splunk.

CIRCL Passive SSL

To use the CIRCL Passive SSL service, you will be required to have a valid account which should be asked to the CIRCL directly through the following page https://www.circl.lu/services/passive-ssl/.

Detailled information about the service can also be found on the above page.

App Setup

After downloading this app, install it like any other app, either through the WebUI, either through the command line, it's up to you.

Then, you will need to edit the file pssl_lookup.py located in $SPLUNK_HOME/etc/apps/pssl/bin/

You only need to edit this file to configure your service account. For example, if your account username is "John" and your password is "1234567", proceed as follow:

Change this:

username = "<YOUR USERNAME>"

password = "<YOUR PASSWORD>"

To this:

username = "John"

password = "1234567"

Save and quit. You are done with the setup!

Usage

This app provides two scripted lookups :

  • `pssl_resolve(hostname)`

This lookup is a simple and naive hostname resolver to get the IPv4 address of the provided hostname. In case of failure, None is returned.

It's not directly linked to the Passive SSL service offered by CIRCL, but quite mandatory practically speaking because the Passive SSL service only works with IPv4 addresses as input.

The lookup notation is as follow:

... | lookup pssl_resolve_lookup domain as <your_field>

  • `pssl(cidr)`

This lookup is what will query the CIRCL Passive SSL service. As input you can have either an IPv4 or either a CIDR notation (ex: 192.168.1.1/28). Note that at this moment the API do not handle mask lower than /23.

The lookup notation is as follow:

... | lookup pssl_lookup cidr as <your_field>

Example

In this example, we will assume Proxy logs. Those logs will contains a field named cs_method describing the HTTP method used and cs_uri which contains the requested page.

The query will be the following:

  1. Filter the sourcetype to only consider log lines using the CONNECT method, relevant of SSL connections.
  2. Drop every fields except the field cs_uri which contains the url destination
  3. Dedup the destinations url using the stats command
  4. Parse the destinations url using UTBox (ut_parse_simple, see below)
  5. Drop every fields except the field ut_netloc created by UTBox
  6. Remove the potential port specification using rtrim()
  7. Resolve the domain name to an IPv4 address
  8. Filter out domain that are not resolved
  9. Query the CIRCL Passive SSL database using the resolved IPv4
  10. Finally, display the results in a table.

The query:

sourcetype="proxy" cs_method="CONNECT" cs_uri=* NOT cs_uri=-

| fields cs_uri

| stats count by cs_uri

| `ut_parse_simple(cs_uri)`

| fields ut_netloc

| eval netloc=rtrim(ut_netloc, ": 0123456789")

| `pssl_resolve(netloc)`

| search ip != None

| `pssl(ip)`

| table netloc ip circl_pssl

Notes:

  • Steps 7 and 9 can significally slow down your whole query as each time an event enter those lookups, a query to Internet is made.

  • UTBox is available here: https://splunkbase.splunk.com/app/2734/

Release Notes

Version 1.0
June 26, 2015

Created by Splunk Security Practice

6
Installs
218
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.