docs: link to releases

and add toc
This commit is contained in:
Ming Di Leom 2023-01-27 21:05:06 +00:00
parent 391fa177f6
commit 4ab8ebf276
No known key found for this signature in database
GPG Key ID: 32D3E28E96A695E8
1 changed files with 24 additions and 2 deletions

View File

@ -1,7 +1,25 @@
# Splunk Add-on for malware-filter
- [Installation](#installation)
- [Usage](#usage)
- [geturlhausfilter](#geturlhausfilter)
- [getphishingfilter](#getphishingfilter)
- [getpupfilter](#getpupfilter)
- [getvnbadsitefilter](#getvnbadsitefilter)
- [getbotnetfilter](#getbotnetfilter)
- [getbotnetip](#getbotnetip)
- [getopendbl](#getopendbl)
- [getopendbl](#getopendbl)
- [Disable individual commands](#disable-individual-commands)
- [Build](#build)
Provide custom search commands to update [malware-filter](https://gitlab.com/malware-filter) lookups. Each command downloads from a source CSV and emit rows as events which can then be piped to a lookup file or used as a subsearch. Each command is exported globally and can be used in any app. This add-on currently does not have any UI.
## Installation
Releases are available at https://gitlab.com/malware-filter/splunk-malware-filter/-/releases
Instruction to build the latest commit is available at the [Build](#build) section.
## Usage
```
@ -124,13 +142,17 @@ Recommend to update the lookup file "opendbl_ip.csv" every 15 minutes (cron `*/1
Source: https://opendbl.net/
## Disabling individual commands
## Disable individual commands
Settings -> All configurations -> filter by "malware_filter" app
## Build
`python build.py`
```
git clone https://gitlab.com/malware-filter/splunk-malware-filter
cd splunk-malware-filter
python build.py
```
## Disclaimer