Splunk unknown experimental spl
Monitor Web Traffic For Brand Abuse
The following analytic identifies web requests to domains that closely resemble your monitored brand's domain, indicating potential brand abuse. It leverages data from web traffic sources, such as web proxies or network traffic analysis tools, and cross-references these with known domain permutations generated by the "ESCU - DNSTwist Domain Names" search. This activity is significant as it can indicate phishing attempts or other malicious activities targeting your brand. If confirmed malicious, attackers could deceive users, steal credentials, or distribute malware, leading to significant reputational and financial damage.
Detection Logic
| tstats `security_content_summariesonly`
values(Web.url) as urls
min(_time) as firstTime
from datamodel=Web
by Web.src
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`
| lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse
| search domain_abuse=true
| `monitor_web_traffic_for_brand_abuse_filter` False Positives
- ⚠ No false positives have been identified at this time.
Field Validations
Loading…
Comments (0)
Loading comments...