icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Splunkbase will be undergoing a scheduled migration and will be unavailable on Saturday, Oct 1, 2022, from 11AM to 3PM PDT

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Stamus Networks App for Splunk
SHA256 checksum (stamus-networks-app-for-splunk_0921.tgz) cce12d232fb06b9b09d9278b0bf07aec824b5d8c28505c65f0ca96eff21fae6c SHA256 checksum (stamus-networks-app-for-splunk_0920.tgz) 57fe2a0f036cd4d76eaa210daeed2882869a682c78e3196502571adfb31f8d98 SHA256 checksum (stamus-networks-app-for-splunk_0919.tgz) b9dfe6205ad538c7933706bb5d93247aff574a0540de3507e2d0ed673f559d88 SHA256 checksum (stamus-networks-app-for-splunk_0917.tgz) cc2bc73f965f447ca083a68b275e8c79b891dc694c9407951a2743cade4625e1 SHA256 checksum (stamus-networks-app-for-splunk_0916.tgz) 98f416edfcb1290f66c722a1b3faa96c88ab75845c2cdabca0f84ec090cd2465 SHA256 checksum (stamus-networks-app-for-splunk_0913.tgz) 9295bfd96265939d19b55e0ecf28cc8a85855e93ef72c5bdd667e97e6a8d2e4c SHA256 checksum (stamus-networks-app-for-splunk_0912.tgz) b861acc12a0b5959c829317e43a98aa7869258324249092ff2e05576066f3a31 SHA256 checksum (stamus-networks-app-for-splunk_0911.tgz) ebec9a999e4f7d58efd6b8c465b1f504d85993c2d5ee93dd8d5346c82b0724a4 SHA256 checksum (stamus-networks-app-for-splunk_0910.tgz) 0d898a6d26184d37465c764e52cc2869cec8abe3e311b3e892f94de1d63d7e09 SHA256 checksum (stamus-networks-app-for-splunk_097.tgz) bb6460248fa323d6ca21e5e28bb6370413a9a54e35b81dbb2492ebe0225f93ab SHA256 checksum (stamus-networks-app-for-splunk_096.tgz) 34a40461826b704f5343cced443b0ea4e6bd79304cd574729d5d6d39fdfdd503 SHA256 checksum (stamus-networks-app-for-splunk_095.tgz) 3a5c60855be7697ae0a89843dfbf43dd9588d07a8a6fbb677801aa2faabd7647 SHA256 checksum (stamus-networks-app-for-splunk_094.tgz) 558af07c353bb96d537f1a6a63004a4e5ef465adc7ba3db606f9359cc97e243c SHA256 checksum (stamus-networks-app-for-splunk_092.tgz) 858609551bad7e29825604e3d6eb06f8091032db3839387355c332a469a8e9d5 SHA256 checksum (stamus-networks-app-for-splunk_091.tgz) 3428dd828256eff655ddceaa6aa997f6e9d7df26560929756c5247f3e5b202e7 SHA256 checksum (stamus-networks-app-for-splunk_090.tgz) 62b5b807b0bafecd7397568136474716a33e23481d6018807102bbaa7defd46a
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Stamus Networks App for Splunk

Splunk Cloud
The Stamus Networks App for Splunk enables threat hunters, incident responders and other security practitioners who use Splunk to tap into the power of Stamus Network Detection and Response (Stamus NDR) or Suricata to more effectively do their job.

Stamus Networks develops advanced network threat detection and response solutions, including the Stamus NDR and the open source SELKS.

Stamus NDR is used by security practitioners worldwide to expose real threats to their critical assets, empower their team’s rapid response, and mitigate their organization's risk. Its analytics engine that sits atop a unique combination of network traffic analysis (NTA), network intrusion detection (IDS) and organizational context allows users to quickly detect, investigate, and respond to threats and security policy violations.

The Stamus Networks App for Splunk allows Splunk Enterprise users to extract information and insights from both the Stamus NDR and open source Suricata sensors. It provides dashboards and reports but also a set of commands to interact with Stamus NDR via its REST API.

To learn more about Stamus NDR visit this page: https://www.stamus-networks.com/stamus-ndr

The Stamus Networks App for Splunk enables threat hunters, incident responders and other security practitioners who use Splunk to tap into the power of Stamus Network Detection and Response (Stamus NDR) or Suricata to more effectively do their job.

The Stamus Networks App for Splunk allows Splunk Enterprise users to extract information and insights from both the Stamus NDR and open source Suricata sensors. It provides dashboards and reports but also a set of commands to interact with Stamus NDR via its REST API.

Sources of the App are available on Github.

Initial Setup

Some visualizations depend on Timeline App and URL Toolbox that will have to be installed if not present on your Splunk® instance.

Stamus Network Detection and Response users need to setup the connectivity with their Stamus Security Platform (SSP). To do so, you need to create a file local/ssp.conf under the application directory (/opt/splunk/etc/apps/stamus_for_splunk usually) and setup the following:

api_key = SSP_TOKEN
base_url = https://SSP_ADDRESS
check_tls = no

The SSP_TOKEN can be generated from Stamus Security Platform by going to Account Settings via the user icon on the top right and selecting Edit token. Only read access is necessary so a user with low privilege can be used.

Included dashboards and reports

Dashboards for Stamus NDR

  • Stamus Networks Dashboard
  • Stamus Networks IDS Dashboard
  • Stamus Networks IP Investigation Dashboard
  • Stamus Networks NTA Dashboard
  • Stamus Networks Threat Radar Dashboard

Dashboards for Suricata Sensors

  • Suricata Admin Dashboard
  • Suricata Events Dashboard
  • Suricata for Zeek Users Dashboard
  • Suricata for IDS Dashboard
  • Suricata for IP Investigation Dashboard


  • Assets under Attack
  • Domain Controllers List
  • HTTP Servers
  • HTTP Servers not running on port 80
  • New Services on Known Hosts by Stamus Networks
  • Recent services by Stamus Networks
  • TLS Servers
  • TLS servers not running on port 443
  • Threats by Network

Using data from Host Identification module of SSP


Stamus NDR features a Host Identification module that builds identity cards of IP addresses seen
in the network without storing all raw events. This provides a concise view of the major attributes that can be linked to an IP address.

An host identification entry includes:

  • List of hostnames associated with the IP
  • List of usernames that connected to this IP
  • List of network services
  • List of HTTP user agents
  • List of TLS agents (using JA3 technology)
  • List of SSH agents

All this information is associated with a first-seen and last-seen timestamp, so it is possible to know
precisely when a username or a HTTP user agent was first seen on a given IP address.

Host ID search

To get software version of all HTTP server in a network (here internet):

| snhostsearch filter="services.values.app_proto=http net_info.agg=internet"| spath "services{}.values{}.http.server" | top "services{}.values{}.http.server"

To get all hosts that are not running a version curl:

| snhostsearch filter="http_user_agent.agent!=curl*" | spath http_user_agent{}.agent output=agent | spath ip | top ip, agent

Host ID filter

The snhostfilter commands allow you to select only events where src_ip or dest_ip is in the host ID set defined by the filter.

The following search returns all alerts for hosts running a service on port 443.

event_type="alert" | snhostfilter filter="services.port=443"

Host ID lookup

The snhostlookup lookup resolves ip to hostname (and reverse) using the hostname information collected by SSP.

The following search returns all alert events and resolve destination ip to hostname.

event_type="alert"| lookup snhostlookup ip as dest_ip| stats count by hostname

Using data from Stamus Threat events


The threat radar inside Stamus NDR generates events with type stamus that are high fidelity events generated from signatures or custom algorithms. These events are also mapped to the cyber kill chain to identify the phase of the attack.

Thread ID lookup

Get threat by network and use snthreatfilter to do threat_id resolution:

event_type="stamus" | eval Network = if('stamus.asset_net_info' == "", "Unknown", 'stamus.asset_net_info') | snthreatfilter | stats dc(stamus.asset) as Assets by Network, threat_name

You can also lookup the Threat Family information via the snthreatfamilylookup:

event_type="stamus" | lookup snthreatfamilylookup family_id as stamus.family_id | top family_name

Release Notes

Version 0.9.21
July 11, 2022

Update Splunk SDK.

Version 0.9.20
July 11, 2022

Fixes for multi node deployment and integration with Splunk Enterprise Security

Version 0.9.19
April 20, 2022

A new lookup to fetch signature definition from Stamus Security Platform has been added. Integration with complex infrastructure and Splunk Enterprise Security has been improved.

Version 0.9.17
Feb. 16, 2022

Fix for deployment where stamus_index macros that was missing.

Version 0.9.16
Oct. 21, 2021

Add a file transfer information dashboard for Suricata and Stamus Networks users.

Version 0.9.13
Aug. 26, 2021

Improve the CIM support.

Version 0.9.12
Jan. 13, 2021
  • New setting to define index to use for all requests
  • Fix for some REST API call
Version 0.9.11
Dec. 10, 2020
  • improve Suricata IDS and NSM dashboards
  • better probe admin dashboard
  • better drilldown
Version 0.9.10
Dec. 4, 2020

This release introduces:
- 2 new anomaly dashboards based on NSM and host ID data for Scirius Security Platform.
- 1 anomaly dashboard based on NSM data for Suricata sensors.

Version 0.9.7
Oct. 16, 2020
  • Add drill down to dashboards
  • Minor display fixes in dashboards
Version 0.9.6
Oct. 13, 2020
  • Add compatibility with Splunk 7.x
Version 0.9.5
Oct. 12, 2020
  • Better navigation
  • Update colors
  • Fix admin dashboard for multiple probes
Version 0.9.4
Oct. 5, 2020
  • CIM 4.x compatibility
  • keys option added to snhostfilter for easy cross source filtering
  • rename all commands with a sn prefix for better completion
  • performance optimizations of dashboards
Version 0.9.2
Sept. 30, 2020
  • Improve IDS dashboards
  • Fix timestamp pickers in Suricata admin Dashboard
Version 0.9.1
Sept. 30, 2020

Fix errors and warnings found by the application checker.

Version 0.9.0
Sept. 30, 2020

Initial release.

- dashboards for Suricata and Scirius Security Platform from Stamus Networks
- hostidsearch: search host identification entries in Scirius Security Platform
- hostidfilter: filter query on host matching a request done in host identification entries
- stamusthreatfilter: resolves Stamus threat id to Stamus threat name
- hostidlookup: do ip to hostname resolution and reverse using host identification data

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.