This supporting add-on provides an external lookup called sslcert_lookup to collect the attributes of an SSL cert at a given address and port. It is built on the Splunk SDK.
Possible use-cases:
- Enrich ip addresses in a search with a certificate's common name (ssl_subject_common_name) or the certificate's subject alternative name (ssl_subject_alt_name) to gain intelligence of what might be the endpoint of the ip at that current time.
- Using makeresults or inputlookup commands, monitor a set of IPs or hostnames for expiring certs and alert
- Using the collect command to store a history of certificate changes
Version: 1.1.3
Lookup reference:
Given the input of a domain or ip address and optionally a connecting port (defaults to https 443 port if not specified), the sslcert_lookup returns various attributes of an SSL certificate.
Note this is not designed as an input (though that does not stop you from using the collect command) and is meant to only be installed on the search head (like any other app). No further setup required after install only particular SPL syntax required.
search * | lookup sslcert_lookup dest AS <search\_field\_with\_domain\_or\_ip> [dest_port AS <search\_field\_with\_port>] [OUTPUT <specfic\_field\_list>]
dest field from search
Syntax: * | lookup sslcert_lookup dest AS <search\_field\_with\_domain\_or\_ip>
Description: Specify a field with a domain or ip address value.
dest_port field from search
Syntax: * | lookup sslcert_lookup dest AS <search\_field\_with\_domain\_or\_ip> dest_port AS <search\_field\_with\_port>
Description: Specify a field with a port to connect to.
Default: 443
Simple method for running the sslcert_lookup.
search * | `sslcert(<search\_field\_with\_domain\_or\_ip> [, <search\_field\_with\_port>])`
dest field from search
Syntax: * | `sslcert(<search\_field\_with\_domain\_or\_ip>)`
Description: Specify a field with a domain or ip address value.
dest_port field from search
Syntax: * | `sslcert(<search\_field\_with\_domain\_or\_ip>, <search\_field\_with\_port>)`
Description: Specify a field with a port to connect to.
Default: 443
dest,dest_port,ssl_end_time, ssl_engine, ssl_hash, ssl_is_valid, ssl_issuer, ssl_issuer_common_name, ssl_issuer_email, ssl_issuer_locality, ssl_issuer_organization, ssl_issuer_state, ssl_issuer_street, ssl_issuer_unit, ssl_name, ssl_policies, ssl_publickey, ssl_publickey_algorithm, ssl_self_issued, ssl_self_signed, ssl_serial, ssl_session_id, ssl_signature_algorithm, ssl_start_time, ssl_subject, ssl_subject_alt_name, ssl_subject_common_name, ssl_subject_email, ssl_subject_locality, ssl_subject_organization, ssl_subject_state, ssl_subject_street, ssl_subject_unit, ssl_validity_window, ssl_version
| makeresults | eval dest="splunk.com" | lookup sslcert_lookup dest
| makeresults | eval dest="splunk.com" | `sslcert(dest)`
| makeresults | eval dest="8.8.8.8" | lookup sslcert_lookup dest
| makeresults | eval dest="mysplunkserver", dest_port=8000 | lookup sslcert_lookup dest dest_port
| makeresults | eval dest="mysplunkserver", dest_port=8000 | `sslcert(dest, dest_port)`
| makeresults | eval dest="8.8.8.8" | lookup sslcert_lookup dest OUTPUT ssl_subject_common_name
| makeresults | eval dest="8.8.8.8" | lookup sslcert_lookup dest OUTPUT ssl_subject_common_name ssl_subject_alt_name | eval ssl_subject_alt_name = split(ssl_subject_alt_name,"|")
Updated splunklib from 1.7.3 to 2.0.2
Fix for unknown or unreachable host and adding dest_port field to always have a value (thanks to Chris Barrett). Updated splunklib from 1.6.18 to 1.7.3. Updated asn1crypto from 1.4.0 to 1.5.1.
Updated splunklib from 1.6.14 to 1.6.18. Updated asn1crypto from 1.3.0 to 1.4.0.
Fixed app for Windows deployments. Updated to latest splunklib.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.