Shadowserver Reports for Splunk

This is a Splunk Modular Input Add-On for indexing Shadowserver intelligence reports.

Install

From the Apps menu, select Manage Apps.

Click the Install app from file button.

Click the Browse... button and select the shadowserver_reports.spl file.

Click Upload.

Add Instance

From the Settings menu, select Data|Data inputs.

In the list of Local inputs locate Shadowserver Reports and click the + Add new link to the right.

The name, API Key, and API secret fields are required.

Check the More settings box to set the desired interval to check for reports. If the interval field is not set, the add-on will only run once.

The interval can be set to 3600 for hourly or 15 * * * * to check 15 minutes after every hour.

A cron schedule has five elements (from left to right):

Minute: 0-59
Hour: 0-23
Day of the month: 1-31
Month: 1-12
Day of the week: 0-6 (where 0 = Sunday)

The destination index may also be set after checking the More settings box.

Multiple instances of the Add-on can be created to partition events into different destinations by specifying Reports and/or Types.

Configuration Example

Instances configured from the web interface are stored in an inputs.conf file. The following is a sample configuration to import the Device Identification Report:

[shadowserver_reports://device_id]
api_key = ........-....-....-....-...........
secret = ..........
types = device_id
disabled = 0

Manual Run

The add-on can be run manually as follows:

(cd $SPLUNK_HOME;bin/splunk cmd splunkd print-modinput-config shadowserver_reports shadowserver_reports://device_id | bin/splunk cmd python etc/apps/shadowserver_reports/bin/shadowserver_reports.py)

Where $SPLUNK_HOME is the directory that Splunk has been installed and shadowserver_reports://device_id matches the name of the instance you want to run as configured in $SPLUNK_HOME/var/run/splunk/confsnapshot/baseline_local/apps/shadowserver_reports/local/inputs.conf.

This will send the data stream that would be indexed to stdout.

The list of report files processed can be seen in $SPLUNK_HOME/var/lib/splunk/modinputs/shadowserver_reports. The checkpoint files may be removed to re-import the given report.