ReversingLabs Search Extension
Overview
Details
ReversingLabs Search Extension for Splunk
The ReversingLabs Search Extension for Splunk is a Splunk Enterprise and Splunk Cloud compatible app created to provide the user
with custom ReversingLabs threat intel within Splunk Search.
Configuring the app
After installing the app, you need to configure it using the app setup page by clicking the "Setu up now" button or by clicking
on the app in the main Splunk menu.
The setup page will prompt you for your TitaniumCloud user account credentials. Please insert the following credentials:
- TitaniumCloud username - The username starting with "u/" that you received from ReversingLabs
- TitaniumCloud password - The password for the mentioned username
After submitting the credentials, you will be redirected to Splunk Search.
How this app works
The Search Extension app is a Splunk att that includes a ReversingLabs custom search command which enables enriching the search results
with various threat intel received from ReversingLabs.
By using the reversinglabs command in your search query, your Splunk instance queries ReversingLabs APIs and adds useful threat intelligence and reputation info
to returned search records.
Using the app
The app can be used on any Splunk index with record fields containing the following data:
- hashes
- file_reputation_hash and file_analysis_hash parameters
- URLs
- network_reputaion_location parameter
- IP addresses
- network_reputaion_location
- domains
- network_reputaion_location parameter
To trigger the reversinglabs command, we recommend using some of the following queries:
File Reputation parameter
index=tiscale container_hash=*
| reversinglabs file_reputation_hash=container_hash
File Analysis parameter
index=tiscale container_hash=*
| reversinglabs file_analysis_hash=container_hash
Network Reputation parameter *
index=tiscale url_field=*
| reversinglabs network_reputaion_location=url_field
- *The
network_reputaion_locationparameter can be used with fields containing a URL, IP address or a domain.
Example queries explained
The tiscale index
The tiscale index is an index created automatically by the ReversingLabs TitaniumScale Dashboard app for Splunk. To use this index, you will
need the following:
- The ReversingLabs TitaniumScale Dashboard app for Splunk (https://splunkbase.splunk.com/app/4318)
- A TitaniumScale instance configured to send adjusted file analysis records to the tiscale index on your Splunk instance
Although we recommend using our custom command on the tiscale index that contains structured analysis reports, you can also use the command
on any other structured record containing fields with the above-mentioned types of data.
Ensuring the returned records have the required field
To make sure all the returned records have the field you want to use as the command parameter, use field_name=* in your search query
before calling the command. This returns only the records that have the desired field recognized and parsed inside of them.
ReveringLabs API query quota
Results for each Splunk record equal to one query deducted from you ReversingLabs API query quota.
Questions and issues
For all other questions and issues related to our apps, contact our support at support@reversinglabs.com
Release Notes
Version 1.0.4
- The app now ensures the use of Python 3.9
Version 1.0.2
- Updates the Python SDK for Splunk to the latest version.
Version 1.0.1
- Fixes minor bugs related to querying "unknown" samples
Version 1.0.0
- Initial release of ReversingLabs Search Extension (v1.0.0)
- Provides the
reversinglabscustom search commmand with three different parameters:file_reputation_hash,file_analysis_hashandnetwork_reputation_location