Reference IP Reuse Domains in Splunk Queries

Forescout eyeExtend for Spunk integrates between the eyeSight and Splunk.

IP Reuse Domains are used to distinguish several instances of an overlapping IP address. IP addresses are unique in each IP Reuse Domain and cannot overlap within a domain.

Splunk support for IP Reuse Domains is asymmetrical: Splunk can retrieve the IP Reuse Domain value and use it to distinguish endpoints with overlapping IPv4 addresses in retrieved data. However, eyeExtend for Splunk cannot use the IP Reuse Domain to apply actions or adaptive response functions to an endpoint with an overlapping IP address.

Modify Splunk Queries to Include IP Reuse Domain Information

Follow these guidelines to modify Splunk queries so they retrieve IP Reuse Domain information and distinguish endpoints with overlapping IP addresses. The IP Reuse Domain is provided by the area_code field.

Modify queries or dashboard/alert statements that use ct_hostinfo as a datasource, or have fillnull, dedup ip or ip statements.

To use the area_code variable in a Splunk query to distinguish overlapping IP addresses:

  1. Add the following statement: rename host_properties.area_code {}.value as area_code
  2. Add area_code to fillnull statements.
  3. Add area_code as part of dedup statements.

    In the following example, the query es_trigger_bad_dns_notification is modified.

    Original QueryModified Query
    ` get_index ` ` get_sourcetypes ` ` ct_hostinfo ` dnsniff_event ` get_index ` ` get_sourcetypes ` ` ct_hostinfo ` dnsniff_event
    rename host_properties.dnsniff_event {}.value as dnsniff_event rename host_properties.dnsniff_event {}.value as dnsniff_event rename host_properties.area_code {}.value as area_code
    mvexpand dnsniff_event mvexpand dnsniff_event
    rex field= dnsniff_event "DNS Query Type:\s*(?< DNSQueryType >[^;^$]);DNS Query/Response: Query;DNS Zone: ;DNS Addresses." rex field= dnsniff_event "DNS Query Type:\s*(?< DNSQueryType >[^;^$]);DNS Query/Response: Query;DNS Zone: ;DNS Addresses."
    search DNSQueryType ="A" search DNSQueryType ="A"
    fillnull value="" ip ipv6 mac fillnull value="" ip ipv6 mac area_code
    eventstats count as eventcount by ip ipv6 mac eventstats count as eventcount by ip ipv6 mac area_code
    dedup ip , ipv6, mac dedup ip , ipv6, mac area_code
    where eventcount >5 AND eventcount <=10 where eventcount >5 AND eventcount <=10