parent
391fa177f6
commit
4ab8ebf276
26
README.md
26
README.md
|
@ -1,7 +1,25 @@
|
|||
# Splunk Add-on for malware-filter
|
||||
|
||||
- [Installation](#installation)
|
||||
- [Usage](#usage)
|
||||
- [geturlhausfilter](#geturlhausfilter)
|
||||
- [getphishingfilter](#getphishingfilter)
|
||||
- [getpupfilter](#getpupfilter)
|
||||
- [getvnbadsitefilter](#getvnbadsitefilter)
|
||||
- [getbotnetfilter](#getbotnetfilter)
|
||||
- [getbotnetip](#getbotnetip)
|
||||
- [getopendbl](#getopendbl)
|
||||
- [getopendbl](#getopendbl)
|
||||
- [Disable individual commands](#disable-individual-commands)
|
||||
- [Build](#build)
|
||||
|
||||
Provide custom search commands to update [malware-filter](https://gitlab.com/malware-filter) lookups. Each command downloads from a source CSV and emit rows as events which can then be piped to a lookup file or used as a subsearch. Each command is exported globally and can be used in any app. This add-on currently does not have any UI.
|
||||
|
||||
## Installation
|
||||
|
||||
Releases are available at https://gitlab.com/malware-filter/splunk-malware-filter/-/releases
|
||||
Instruction to build the latest commit is available at the [Build](#build) section.
|
||||
|
||||
## Usage
|
||||
|
||||
```
|
||||
|
@ -124,13 +142,17 @@ Recommend to update the lookup file "opendbl_ip.csv" every 15 minutes (cron `*/1
|
|||
|
||||
Source: https://opendbl.net/
|
||||
|
||||
## Disabling individual commands
|
||||
## Disable individual commands
|
||||
|
||||
Settings -> All configurations -> filter by "malware_filter" app
|
||||
|
||||
## Build
|
||||
|
||||
`python build.py`
|
||||
```
|
||||
git clone https://gitlab.com/malware-filter/splunk-malware-filter
|
||||
cd splunk-malware-filter
|
||||
python build.py
|
||||
```
|
||||
|
||||
## Disclaimer
|
||||
|
||||
|
|
Loading…
Reference in New Issue