Boost Your Splunk IP Intelligence with the Criminal IP Search Application

Accelerate IP Intelligence in Splunk with the Criminal IP Search App

While analyzing countless logs in your enterprise security environment, you’ve likely found yourself wondering:

• “Is this IP address safe?”
• “Who is accessing our network?”
• “Is this connection coming through a VPN or the Tor network?”

Now, you can get instant answers to these questions — directly within Splunk — using the Criminal IP Search app.

This powerful app integrates seamlessly with Splunk to analyze IP addresses in real-time against the Criminal IP Threat Intelligence Database, offering automated insights and visualizations of IP characteristics and associated risk levels — all without leaving your Splunk interface.

Real-Time Threat Detection in Splunk

The Criminal IP Search app is built on Splunk’s streaming custom command architecture. It analyzes IP addresses from logs in real-time by integrating with the Criminal IP intelligence database.

If you’ve already connected logs from Web Application Firewalls (WAFs), Fortinet, or other network security devices to Splunk, this app can help you answer crucial questions, such as:

• How many malicious IPs are trying to access our services?
• Are there any suspicious outbound communications from internal hosts?
• How many access attempts are being made through VPN, Tor, or Proxy networks?

Unlike basic filtering tools, Criminal IP Search enables qualitative analysis of IP behavior, providing deeper insights into potential threats.

Key Features

1. Real-Time IP Intelligence Lookup

Use the criminalip command within Splunk Search to query IP intelligence data instantly.

• Risk scores based on inbound/outbound activity
• Identification of malicious infrastructure based on dozens of threat indicators

2. Malicious Infrastructure Detection

Criminal IP classifies and detects threats in real-time across the following categories:

Get Criminal IP’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

TypeDescriptionMobileIPs from cloud infrastructure or hosted environmentsSnortIPs used in mobile environmentsVPNAnonymized IPs via proxy serversTorAutomated IPs used for port scanning and probingProxyIPs flagged by the Snort IDS networkScannerConnections from the Tor networkHostingAnonymized IPs used through VPNs

These indicators are added to your Splunk logs as structured fields — such as issue, proxy, and scanner — enabling easy filtering and visualization.

Installation & Usage Guide

1. Download and install the Criminal IP Search app from Splunkbase
2. Restart Splunk.
3. Sign up for Criminal IP and generate your API key.
4. Enter the API key in the app’s settings page.
5. Use the criminalip command in Splunk Search to run real-time IP intelligence queries.

* Note: When querying a large number of IPs, API calls are made in real-time, which may affect response times. For optimal performance, we recommend querying up to 300 IPs at a time.

Sample Commands:​

• Single IP lookup: criminalip ip_address=”1.1.1.1″​
• Batch IP lookup: eval ip_address=dst_ip |criminalip​
• Filter specific fields: eval ip_address=dst_ip |criminalip |table ip_address,outbound_score,issue,proxy,scanner​

GitHub Repository: https://github.com/criminalip/CriminalIP-Splunk-Search-IP ​

Real-World Use Cases

1. Enhance SIEM Detection Rules

Incorporate Criminal IP’s external threat intelligence to enrich existing detection logic and improve threat prioritization.

2. Detect Users Who Bypass Access Controls

Identify and respond to users accessing networks through VPN, Tor, or proxy in real time. This is especially useful in SaaS environments or internal network protection.

3. Automate Security Reporting

Automatically generate daily or weekly reports based on IP risk scores and threat indicators — supporting compliance, audits, and executive reporting.

Conclusion

Until now, IP analysis in Splunk was often limited to internal detection rules or narrow sets of threat data. The Criminal IP Search app changes this by providing real-time, global threat intelligence that seamlessly integrates into your existing Splunk workflows.

Setup is simple, but the results are powerful. Detect anomalous IP behavior, refine detection policies, and boost security visibility — all in one place.

Additional Resources

• GitHub Documentation: https://github.com/criminalip/CIP-FDS (App-specific documentation to be updated sequentially)
• Technical Inquiries: support@aispera.com