Flagging suspect IP addresses

Any server that receives requests from clients will always be a potential target for someone to try and exploit by initiating an attack. Attacks can come in many different forms, and over time it is important to keep a history of the originating source of the attack, so we can monitor the behavior and patterns more closely and potentially use this data to block access as needed.

In the next recipe, you will learn how to store the source IP addresses of clients making erroneous web access requests as a lookup and flag them for suspect behavior. This new lookup will then be leveraged to filter a subsequent search.

Get Splunk Operational Intelligence Cookbook - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.