Stairwell App for Splunk
Overview
Details
Stairwell App for Splunk
Add Stairwell enrichment data to your Splunk events with the Stairwell App for Splunk. This application uses Stairwell private malware analysis to integrate directly with your Splunk experience. Enrich Splunk events based on analyis of hostnames, IP addresses and file hashes.
The Stairwell App for Splunk requires a valid Stairwell API license and Splunk user privileges required for app installation. The app makes calls to the Stairwell API. When the app is installed, you'll have access to Stairwell commands that provide data enrichment, extending your defenses beyond the limitations of traditional SIEM tools.
The Stairwell App for Splunk is compatible with Splunk Enterprise 9.4.0+.
For the very latest information on how to use this app visit Stairwell App for Splunk
Details
Streaming Command
This command operates on each event independently resulting from a search. It adds Stairwell enrichment data to each event, given a matching field passed as an argument to the stairwell command is present.
There are 3 types of data currently supported:
Hostnames
Example: find any field in the event called "host" and add Stairwell hostname enrichment data to it.
| makeresults | eval host = "google.com" | stairwell hostname="host"
IP Addresses
Example: find any field in the event called "ip" and add Stairwell IP address enrichment data to it.
| makeresults | eval ip = "192.168.0.1" | stairwell ip="ip"
Objects (file hashes)
File hashes currently supported include MD5, SHA1, SHA256.
Example: find any field in the event called "hash" and add Stairwell object enrichment data to it.
| makeresults | eval hash = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da" | stairwell object="hash"
What Stairwell enrichment data is provided?
See Stairwell App for Splunk for up-to-date details.
Release Notes
Version 1.1.0
- Improves stability of requests made to the Stairwell enrichment API.
- Deprecates legacy request routing.
- Adds field validation and increased output readability (ex. better timestamp display).
- Includes minor bugfixes and documentation improvements.