Stairwell App for Splunk
Overview
Details
Stairwell App for Splunk
Add Stairwell enrichment data to your Splunk events with the Stairwell App for Splunk. This application uses Stairwell private malware analysis to integrate directly with your Splunk experience. Enrich Splunk events based on analyis of hostnames, IP addresses and file hashes.
The Stairwell App for Splunk requires a valid Stairwell API license and Splunk user privileges required for app installation. The app makes calls to the Stairwell API. When the app is installed, you have access to Stairwell commands to provide data enrichment that extends your defenses beyond the limitations of traditional SIEMS tools.
The Stairwell App for Splunk is compatible with Splunk Enterprise 9.4.0.
For the very latest information on how to use this app visit Stairwell App for Splunk
Details
Streaming Command
This command operates on each event independently resulting from a search. It adds Stairwell enrichment data to each event that matches the type of data and the criteria given.
There are 3 types of data currently supported:
Hostnames
Example: find any field in the event called "host" and add Stairwell hostname enrichment data to it.
| makeresults | eval host = "google.com" | stairwell hostname="host"
IP Addresses
Example: find any field in the event called "ip" and add Stairwell IP address enrichment data to it.
| makeresults | eval ip = "192.168.0.1" | stairwell ip="ip"
Objects (file hashes)
File hashes currently supported include MD5, SHA1, SHA256.
Example: find any field in the event called "hash" and add Stairwell object enrichment data to it.
| makeresults | eval hash = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da" | stairwell object="hash"
What Stairwell enrichment data is provided?
See Stairwell App for Splunk for details.