This app adds a custom command called cssmoke
This command enables users to query an IP and receive enrichment from CrowdSec CTI API. Enrichment includes information about the IP, such as what kind of attacks it has been participant of as seen by CrowdSec's network. It also includes enrichment by CrowdSec like background noise score, aggressivity over time etc.
After completing the setup of App by providing the CrowdSec CTI API key. See guide on getting it here, you can test the custom command via this example:
| makeresults | eval ip="8.8.8.8" | cssmoke ipfield="ip"
cssmoke:
ipfield:
On the event of clicking the Search button, users will be able to veiw a brief overview of various fields associated with the input IP address. This includes but not limited to location, behaviors, classifications, attack details – name, label, description, references followed by scores, threats, etc.
Using the latest SDK package
Fixed lot of bugs.
Fixed Icon rendering.
Initial implementation of crowdsec splunk app.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.