SANS Blacklist
Version: 3.0.0
SANS Blacklist is a service that utilizes a radically different approach to blacklist formulation called Highly Predictive Blacklisting. Each DShield contributor can now access a unique HPB that reflects the most probable set of source addresses that will connect to that contributor's network over a prediction window that may last several days into the future.
Connect SANS Blacklist with LogicHub
- Navigate to Automations > Integrations.
- Search for SANS Blacklist.
- Click Details, then the + icon. Enter the required information in the following fields.
- Label: Enter a connection name.
- Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
- Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
- Remote Agent: Run this integration using the LogicHub Remote Agent.
- API Key: The API key to connect to the SANS Blacklist.
- After you've entered all the details, click Connect.
Actions for SANS Blacklist
IP Lookup
Submit an IP address to perform a lookup against SANS's IP range blacklist.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
IP Column | Column name from parent table to lookup value for IP. | Required |
Output
A JSON object containing multiple rows of result:
- has_error: True/False
- error: message/null
{
"has_error": true,
"error": "IP is mandatory"
}
Release Notes
v3.0.0
- Updated architecture to support IO via filesystemv2.0.11
- Bug fix: Parser changed for blocklist.v2.0.5
- Added documentation link in the automation library.
Updated 12 months ago