VT4Splunk automatically enriches your Splunk logs with threat intelligence coming from VirusTotal. It allows you to contextualize IoCs (files/hashes, domains, IP addresses, URLs) and confirm malicious intent/discard false positives. The context added includes: security industry reputation, severity, threat categories and labels, associated campaigns and threat actors, etc.
VT4Splunk app can be installed through UI as is shown below:
Install app from file.Choose file and select the TA-virustotal-app installation file.Upload.By the limitations of Splunk at the time of reading VT API key from indexers VT4Splunk app will always run on the Search Head so the add-on it only needs to be installed on the Search Head as usual, not on the indexers nor in the forwarders.
Configuring VT4Splunk:
Configure proxy settings:
| Enable Proxy | Optional | To enable or disable the proxy |
| Proxy Host | Mandatory | Host or IP of the proxy server |
| Proxy Port | Mandatory | Port for proxy server |
| Proxy Username | Optional | Username of the proxy server |
| Proxy Password | Optional | Password of the proxy server |
Configure the Logging level:
Configuration tab.Logging tab.Save.Configure basic values for the correct operation of the app:
VirusTotal API Key:To test the connection you can execute this Splunk query after save the API key
| makeresults
| eval testip="8.8.8.8"
| vt4splunk ip=testip
Lookup table expiration (days):Configure values which will affect to the automatic correlation and the data shown in the dashboards:
Enable automatic correlation:
Enable this to automatically correlate IoCs found in your events with VirusTotal context. VirusTotal enrichment will be scheduled every 30 minutes and findings will be summarized in the dashboards.
Data freshness (days):
Optimizes your VirusTotal API quota. IoC enrichment will be retrieved from the local cache, instead of performing an API call, whenever the cached analysis' age is lower than this value.
Names for indexes:
Automatic correlation and dashboards will use this list of indexes to perform the search of the events in your catalog.
Fields names [Hash, URL, Domain, IP]:
Saved searches will perform automatic correlation using these field names to find IoCs in your events. Empty field disables that automatic correlation specifically.
The app provides a main command vt4splunk to correlate IoCs found in your events with the VirusTotal information, also provides other commands to keep up-to-date the enrichment dataset:
vt4splunk:Adding the command to a SPL query will enrich events which contains the fieldname passed as argument, adding new fields to the event in search time with the prefix vt_, the command admits the following parameters:
| Parameter | Optional | Description |
|---|---|---|
| hash | domain | url | ip | No | event fieldname |
| nocache | Yes | Boolean lowercase value [true | false] |
Query examples:
sourcetype=access_* status=400 method=POST
| vt4splunk ip=clientip
Correlate clientip field of access log events.
sourcetype=access_* status=400 method=POST
| vt4splunk ip=clientip nocache=true
Forcing to get the enrichment data from VirusTotal instead of the lookup tables.
sourcetype=access_* status=400 method=POST
| vt4splunk ip=clientip nocache=true
| search vt_detections > 10
Get correlated events where detections are more than ten.
The following additional commands are executed periodically by the saved searches, it rarely will be necessary to execute manually.
vtdeleteiocs:Delete IoCs older than 30 days by default. It can be also executed manually given a table with vt_id field as input and/or with some parameter to perform a more selective delete:
| Parameter | Optional | Description |
|---|---|---|
| lookups | Yes | delete iocs of specific types (hash, domain, ip, url) |
| ttl | Yes | delete iocs older than this value (days) |
Query examples:
| makeresults | vtdeleteiocs
Delete all IoCs.
| makeresults | vtdeleteiocs ttl=30
Delete all IoCs older than 30 days.
| inputlookup vt_url_cache | search vt_detections < 10 | vtdeleteiocs lookups=url ttl=5
Delete URLs with less than 10 detections and older than 5 days.
| inputlookup vt_file_cache | search vt_tags=*cve-* | vtdeleteiocs lookups=hash
Delete hashes with CVE tags.
vtadversaryupdate:Keep up-to-date campaigns and threat actors.
vtvulnerabilitiesupdate:Keep up-to-date CVEs.
vtmitreupdate:Extract MITRE information of each hash and keep up-to-date the dashboard.
The app comes with several saved search which will correlated your events and will keep up-to-date the data in an unmanaged way:
VirusTotal Update File LookupVirusTotal Update URL LookupVirusTotal Update Domain LookupVirusTotal Update IP LookupThe above saved searches are in charge of the automatic correlation, they will inspect new events in the last 30 minutes contained only in the indexes configured in the Correlation Settings.
VirusTotal Clean LookupsThis saved search will remove IoCs from the lookup tables older than the value configured in the Correlation Settings, by default 30 days.
VirusTotal Keep Adversary Lookups UpdatedVirusTotal Keep CVE Lookup UpdatedVirusTotal Keep MITRE Lookup UpdatedThe above saved searches keep up-to-date the data shown in the Vulnerability, Adversary and MITRE dashboards.
The app creates several lookup tables to store the enrichment data and to feed the dashboards:
vt_file_cache: store the VirusTotal enrichment data for filesvt_domain_cache: store the VirusTotal enrichment data for domainsvt_url_cache: store the VirusTotal enrichment data for urlsvt_ip_cache: store the VirusTotal enrichment data for ipsvt_collection_cache: store the VirusTotal collections for flagged iocs (Campaigns and malware toolkits)vt_threat_actor_cache: store the VirusTotal threat actors for flagged iocsvt_cve_cache: store the CVEs extracted from file enrichment datavt_mitre_cache: store the MITRE information for filesvt_ignore_cache: store the IoCs to be ignored in the dashboardsAll of the above tables can be inspected running a search query like this: | inputlookup vt_file_cache.
IoCs can be ignored adding them to a specific lookup table, preventing them from appearing in the dashboards, this can be useful if you have a well-known or false positives IoCs.
You can manage those IoCs with these queries: * To add a single IoC:
| makeresults | eval vt_id="eed999fcf63eaa5dd73fac49a7d49d64fe19b945eb30730da4ab026d78746559", vt_type="hash"
| outputlookup append=true vt_ignore_cache
| makeresults format=csv data="vt_id, vt_type
eed999fcf63eaa5dd73fac49a7d49d64fe19b945eb30730da4ab026d78746559,hash
google.com,domain
https://www.google.com,url
127.0.0.1,ip"
| outputlookup append=true vt_ignore_cache
| inputlookup vt_ignore_cache | dedup vt_id vt_type | outputlookup vt_ignore_cache
Saved searches only correlate events created in the last 30 minutes, if you want to do a backfill to start showing data perform a search adding the command vt4splunk as described above.
Check lookup tables have information, if not try to execute the vt4splunk command manually over a search of events.
Check the index names in the Correlation Settings.
Lookup table expiration, Index names and the Enable automatic correlation. Values stored before the upgrade will not work as expected, please, after the upgrade, enter again the configuration in the General and Correlation Settings and save both forms.vt4splunk command locally.vt4splunk command locally.vtdeleteiocs command is able to receive IoCs as input.vt4splunk command process records with non utf-8 encoding.vt_ignore_cache to ignore desired IoCs.| outputlookup vt_mitre_cache
vtmitreupdate to extract tactics and techniques from IoCs._last_correlation_date.vt_tags.vtdeleteiocs to delete iocs selectively.vtadversaryupdate to gather adversary intelligence data from VirusTotal.vtvulnerabilitiesupdate to extract vulnerabilities from the iocs.vt4splunk is executed.vt_malicious has been renamed to vt_detections.| outputlookup vt_file_cache
| outputlookup vt_domain_cache
| outputlookup vt_url_cache
| outputlookup vt_ip_cache
| outputlookup vt_cve_cache
vt4splunk command to enrich events.Email contact@virustotal.com
When contacting to support, please indicate your VT4Splunk version, Splunk version, if Enterprise or Cloud, and some screenshots and logs by executing:
index="_internal" | search source="*ta_virustotal_app*"
To get all logs stored by VT4Splunk.
index="_internal" | search "virustotal" "ERROR"
To get all logs stored by Splunk about VT4splunk.
Copyright (c) 2024 Google. All rights reserved.
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/aiohttp/_websocket.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/aiohttp/_helpers.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/aiohttp/_http_parser.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/aiohttp/_http_writer.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/frozenlist/_frozenlist.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/charset_normalizer/md__mypyc.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/charset_normalizer/md.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/multidict/_multidict.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/lib/yarl/_quoting_c.cpython-39-darwin.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/pvectorc.cpython-37m-x86_64-linux-gnu.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/markupsafe/_speedups.cpython-37m-x86_64-linux-gnu.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/yaml/_yaml.cpython-37m-x86_64-linux-gnu.so: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/cli-arm64.exe: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/cli-64.exe: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/gui-64.exe: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/cli.exe: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/cli-32.exe: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/gui-32.exe: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/gui.exe: this file does not require any source code
/Applications/Splunk/var/data/tabuilder/package/TA-virustotal-app/bin/ta_virustotal_app/aob_py3/setuptools/gui-arm64.exe: this file does not require any source code
Lookup table expiration, Index names and the Enable automatic correlation. Values stored before the upgrade will not work as expected, please, after the upgrade, enter again the configuration in the General and Correlation Settings and save both forms.vt4splunk command locally.vt4splunk command locally.vtdeleteiocs command is able to receive IoCs as input.vt_ignore_cache to ignore desired IoCs.| outputlookup vt_mitre_cache
vtmitreupdate to extract tactics and techniques from IoCs._last_correlation_date.vt_tags.vtmitreupdate to extract tactics and techniques from IoCs._last_correlation_date.vt_tags.vtdeleteiocs to delete iocs selectively.vtadversaryupdate to gather adversary intelligence data from VirusTotal.vtvulnerabilitiesupdate to extract vulnerabilities from the iocs.As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.