parent
							
								
									391fa177f6
								
							
						
					
					
						commit
						4ab8ebf276
					
				
							
								
								
									
										26
									
								
								README.md
								
								
								
								
							
							
						
						
									
										26
									
								
								README.md
								
								
								
								
							|  | @ -1,7 +1,25 @@ | |||
| # Splunk Add-on for malware-filter | ||||
| 
 | ||||
| - [Installation](#installation) | ||||
| - [Usage](#usage) | ||||
| - [geturlhausfilter](#geturlhausfilter) | ||||
| - [getphishingfilter](#getphishingfilter) | ||||
| - [getpupfilter](#getpupfilter) | ||||
| - [getvnbadsitefilter](#getvnbadsitefilter) | ||||
| - [getbotnetfilter](#getbotnetfilter) | ||||
| - [getbotnetip](#getbotnetip) | ||||
| - [getopendbl](#getopendbl) | ||||
| - [getopendbl](#getopendbl) | ||||
| - [Disable individual commands](#disable-individual-commands) | ||||
| - [Build](#build) | ||||
| 
 | ||||
| Provide custom search commands to update [malware-filter](https://gitlab.com/malware-filter) lookups. Each command downloads from a source CSV and emit rows as events which can then be piped to a lookup file or used as a subsearch. Each command is exported globally and can be used in any app. This add-on currently does not have any UI. | ||||
| 
 | ||||
| ## Installation | ||||
| 
 | ||||
| Releases are available at https://gitlab.com/malware-filter/splunk-malware-filter/-/releases | ||||
| Instruction to build the latest commit is available at the [Build](#build) section. | ||||
| 
 | ||||
| ## Usage | ||||
| 
 | ||||
| ``` | ||||
|  | @ -124,13 +142,17 @@ Recommend to update the lookup file "opendbl_ip.csv" every 15 minutes (cron `*/1 | |||
| 
 | ||||
| Source: https://opendbl.net/ | ||||
| 
 | ||||
| ## Disabling individual commands | ||||
| ## Disable individual commands | ||||
| 
 | ||||
| Settings -> All configurations -> filter by "malware_filter" app | ||||
| 
 | ||||
| ## Build | ||||
| 
 | ||||
| `python build.py` | ||||
| ``` | ||||
| git clone https://gitlab.com/malware-filter/splunk-malware-filter | ||||
| cd splunk-malware-filter | ||||
| python build.py | ||||
| ``` | ||||
| 
 | ||||
| ## Disclaimer | ||||
| 
 | ||||
|  |  | |||
		Loading…
	
		Reference in New Issue