misp42splunk version >=3.0.0: this is a major update;
after installation, restart splunk, launch the app and create one misp instance under inputs. It is recommended to name it default_misp. If you need several instances, create additional inputs.
MISP to SPLUNK:
| mispgetioc misp_instance=default_misp _params_ | ... gets MISP event attributes into Splunk search pipeline.
| mispapireport misp_instance=default_misp _params_ | ... gets MISP event attributes into Splunk search pipeline.
search ... |mispsearch misp_instance=default_misp field=myvalue | ... searches for matching attributes in MISP.
search ... |mispsight misp_instance=default_misp field=myvalue | ... gets sighting information for a specific value (note that if there is FP, only first hit is returned)
MISP for SPLUNK: 2 Splunk alert actions are available
This app is designed to run on Splunk Search Head(s) on Linux plateforms (not tested on Windows but it could work)
1. working with master Download this file which is the Splunk app
2. working with other branches Download the ZIP file and extract the folder misp42splunk which actually contains the Splunk app. You have to compress that folder as misp42splunk.tar.gz
3. Install the app on your Splunk Search Head(s): "Manage Apps" -> "Install app from file"
4. At next logon, you should be invited to configure the app (if not go to Manage Apps > misp42 > launch app)
5. create at least one input for example "default_misp"
- provide the url to your MISP instance,
- provide the authkey,
- check (or not) the certificate of the MISP server,
- use (or not) the proxy for this instance,
- provide client certificate if required (and check the box to use it)
Fresh IOC from MISP > saved searches in Splunk
If you have output of analysis pushed to Splunk you may automate the creation of events
Log on sandboxing output > saved search to qualify, sanitize (dedup remove top Alexa, etc.) and prepare the table (misp_, fo_, eo_ and no_) > set a splunk alert to create event(s) in MISP
Only fields prefixed with misp_ (or fo_ for file objects, eo_ for email objects, no_ for network objects) are imported
Advise: for objects, verify the name of the fields to be created Object definitions
* If you provide an eventid, that event is updated with attributes and objects instead of creating a new one. WARNING apparently the API does create duplicate objects if you submit sevral time the same inputs.
Search for attributes values/uuids in Splunk > alert to increment sighting counters (standard,false positive,expiration) in MISP for those values/uuids
Several saved searches are provided to easily create KV store lookups which can be used later. THe default behaviour is to append new event attributes to the KV store but you may switch to replace it.
Based on those searches, you can easily created local CSV files and feed intel to Enterprise Security App.
The creation of this app started from work done by https://github.com/xme/splunk/tree/master/getmispioc and the associated blog https://blog.rootshell.be/2017/10/31/splunk-custom-search-command-searching-misp-iocs/ for MISP interactions.
This app misp42splunk is licensed under the GNU Lesser General Public License v3.0.
- cloud compliant (https only and no log of sensitive data)
- you have to grant "list_storage_passwords" to users/roles
2019-05-21 version 3.0.4
- fix misp_common.py
- fix commands.conf
- improve documentation
2.2.3 - 10/04/2019
- handle mv fields for sighting alerts
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.