GreyNoise Search Add-on for Splunk

Support

• Splunk 7.0, 7.1, 7.2, 7.3

Table of Contents

INSTALLATION

• Hardware and OS requirements
• Installation steps
• Deployment

USER GUIDE

• Commands and Sample Searches
• ES Functionality
• Troubleshooting

OVERVIEW

About GreyNoise Search Addon for Splunk

The GreyNoise Search Add-on for Splunk allows organizations to easily query the GreyNoise API to obtain intel on IPs seen within their logs. The app includes several custom commands and two adaptive response actions.

Release notes

Version 1.1.2 is the third release. You must have a valid GreyNoise API key for this app to function.

About this release

Version 1.1.2 of the GreyNoise Search Addon for Splunk is compatible with:

Prerequisites and Requirements

This app requires a valid GreyNoise API key to function. Search heads without Enterprise Security also require the Splunk Common Information Model (CIM) Add-on to be installed.

Support

INSTALLATION AND CONFIGURATION

Hardware and software requirements

Hardware requirements

GreyNoise Search Addon for Splunk officially supports the following server platforms in the versions supported by Splunk Enterprise:

• Linux (Tested on Ubuntu 16.04)
• macOS (Tested on macOS High Sierra 10.13.6 )

Splunk Enterprise system requirements

Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.

Installation steps

Single-instance

Install to search head

1. Install the app.
2. Click on 'Apps' in the top left corner of the Splunk UI. Then click 'Manage Apps' and search for the app. Click on 'Set up' under the 'Actions' column. Enter the API key and then click Save.

Distributed

Install to search head

1. Install the app.
2. Click on 'Apps' in the top left corner of the Splunk UI. Then click 'Manage Apps' and search for the app. Click on 'Set up' under the 'Actions' column. Enter the API key and then click Save.

Installations on Search Heads without Enterprise Security

1. Install the app.
2. Click on 'Apps' in the top left corner of the Splunk UI. Then click 'Manage Apps' and search for the app.
3. Installation the Splunk Common Information Model (CIM) Add-on. No configuration of this app is necessary.

Adaptive Response

This app contains compatibility with the Enterprise Security feature Adaptive Response.
Responders can perform a quick check or a context check (single IP only) on IPs seen in alerts.

User Guide

Commands and Sample Searches

The following commands are included as part of the add-on:

• gnbulk
  • Search format: | gnbulk
  • Purpose: gnbulk queries GreyNoise for all noise IPs from today generated by internet scanners, search engines, and worms.
  • This command is intended to be used in a saved search to automatically populate a lookup.
• gncontext
  • Search format: | gncontext ip=[ip_address]
  • Purpose: gncontext queries GreyNoise for activity data from a given IP address.
• gnquick
  • Search format: | gnquick ip=[ip_address]
  • Purpose: gnquick queries GreyNoise to check whether a given IP address is "Internet background noise", or
    has been observed scanning or attacking devices across the Internet.

• gnmulti

  • Search format: index=[your_index] | gnmulti ip_field=[ip_field]
  • Purpose: gnmulti returns whether IP address(es) are noise, similar to the gnquick command but able to be
    used for multiple IPs.

• These commands correspond to specific endpoints in the GreyNoise API. Learn more about each endpoint in the
  GreyNoise API documentation.

ES Functionality

• This app comes with two adaptive response actions: GreyNoise Quick Check and GreyNoise Context Check
  • GreyNoise Quick Check returns information from the /v2/noise/quick API endpoint, similar to gnquick.
  • GreyNoise Context Check returns information from the /v2/noise/context endpoint if given a single IP address
    (for example, if used in Incident Response). If given multiple addresses, it returns info from the
    /v2/noise/multi/quick endpoint.
• This functionality can also be used outside of ES on alerts.
• Results from these actions can be found in index=main sourcetype=greynoise
• If executed from Incident Review, results can be accessed directly by refreshing the "Adaptive Responses" panel
  and clicking the appropriate link.

Troubleshooting

• Custom commands return error code 1 when used and search.log contains a key error.
  • Check to see that the API key has been entered correctly in the app's setup page.
• Alerts fail to write to index=main sourcetype=greynoise and Enterprise Security is not installed.
  • Ensure that the Splunk Common Information Model (CIM) Add-on has been installed. No configuration of this add-on is necessary.

Release Notes

v 1.0.0

• Includes the following commands: gnbulk, gncontext, gnquick, gnmulti
• Adaptive Response Actions: Quick Check and Context Check. [See above under 'ES Functionality']

v 1.1.0

• Refactors the gnmulti command to preserve event information when used

v 1.1.1

• Fixed a bug in the gnmulti command that caused an error when over 100 IPs were passed to the API endpoint

v 1.1.2

• Improves error messaging when a multivalued field is passed to the gnmulti command

Third-party software attributions/credits:

requirejs/text.js 2.0.15

(https://github.com/requirejs/text) - MIT License

Copyright jQuery Foundation and other contributors, https://jquery.org/

This software consists of voluntary contributions made by many
individuals. For exact contribution history, see the revision history
available at https://github.com/requirejs/text

The following license applies to all parts of this software except as
documented below:

====

Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.