Splunk Search

Using Splunk to Find Unused Firewall Policies

aferone
Builder

We run a report every week that counts how many times a firewall policy was used. (A firewall policy is represented by a number)

What I would like to do is compare a master list of all the firewall policies that exist against policies that never show up in the logs. If a policy doesn't show up in the logs, then it obviously isn't being used.

Would I use a lookup for this? Would I set up the master list of policies somewhere, then somehow search the logs to see which ones are NOT in the logs? How would I go about achieving something like this?

Thanks!

Tags (1)
0 Karma
1 Solution

aferone
Builder

I tweaked the search from another article and got it to work using this:

index="summary" policy_id=* 
| inputlookup append=t allfirewallpolicies
| rename PolicyID as policy_id
| stats count by policy_id 
| eval count=count-1 
| sort count

Thanks!

View solution in original post

0 Karma

aferone
Builder

I tweaked the search from another article and got it to work using this:

index="summary" policy_id=* 
| inputlookup append=t allfirewallpolicies
| rename PolicyID as policy_id
| stats count by policy_id 
| eval count=count-1 
| sort count

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could store the entire list of firewall policies in a CSV file for example. Say one column for the policy_id, one for a human-readable name. You'd start off your query with inputlookup, then filter that against a subsearch that lists every firewall policy that was used. In pseudosplunk it might look something like this:

| inputlookup firewall_policies.csv | search NOT [subsearch that returns a list of firewall policies that have been used | return policy_id]
0 Karma

aferone
Builder

So I have the lookup uploaded and working, but I can't get the query to run correctly.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The simplest way would be to put it into $SPLUNK_HOME/etc/system/lookups, anything in there can be referenced by file name.

Alternatively, you can define an input table in props.conf and transforms.conf and reference that name. Consult the doc for that: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions

0 Karma

aferone
Builder

Thank you! Where do I place the csv file of the entire firewall policy list?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...