# Reference a known malicious CSV list of I.P Addresses

**URL:** <https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506>\
**Category:** Graylog Central (peer support)\
**Created:** [December 14, 2017, 2:07pm UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506 "2017-12-14T14:07:43Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 14, 2017, 2:07pm UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/1 "2017-12-14T14:07:43Z")

</div>

Hi, is it possible to reference a list on graylog. what i want to do is to compare my source addresses with a list of known malicious addresses i already have on a CSV file. In short, what i want to do is check if my source addresses are accessing any of the malicious addresses.

Thanks

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [December 14, 2017, 3:07pm UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/2 "2017-12-14T15:07:31Z")

</div>

> [@haywhai](#):
>
> what i want to do is to compare my source addresses with a list of known malicious addresses i already have on a CSV file.

[http://docs.graylog.org/en/2.3/pages/lookuptables.html](http://docs.graylog.org/en/2.3/pages/lookuptables.html)

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 15, 2017, 10:19am UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/3 "2017-12-15T10:19:20Z")

</div>

Thanks, i have read about it and i just tried implementing it. but it aint working still. Pls what exactly is wrong? Below are the screenshots

1. screenshot of the csv file

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a6ddf52b468fed936db8bb69487ff14755370dad.png)

1. Data Adapter  

2. Look up table

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/70c052bd3be2a8fc72f3df918087c957bf6c31c2.png)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [December 15, 2017, 10:21am UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/4 "2017-12-15T10:21:07Z")

</div>

> [@haywhai](#):
>
> screenshot of the csv file

What’s the actual content of the file?

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 15, 2017, 10:25am UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/5 "2017-12-15T10:25:57Z")

</div>

suspected malicious i.p addresses and i have close to 2000 rows.

---

<div class="post-metadata">

**Author:** ![haywhai](https://avatars.discourse-cdn.com/v4/letter/h/bbe5ce/32.png) [@haywhai](https://community.graylog.org/u/haywhai)\
**Post date:** [December 15, 2017, 10:27am UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/6 "2017-12-15T10:27:23Z")

</div>

> [@haywhai](#):
>
> Data Adapter

For the **Quote Character** field, i used a space. whereas, the next i.p to check is on the next line. hope it isnt wrong?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [December 15, 2017, 10:41am UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/7 "2017-12-15T10:41:45Z")

</div>

> [@haywhai](#):
>
> suspected malicious i.p addresses and i have close to 2000 rows.

Please provide examples. And a screenshot of Excel is _not_ an example.

> [@haywhai](#):
>
> For the Quote Character field, i used a space. whereas, the next i.p to check is on the next line.

Just leave the default value (double quote).

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [December 15, 2017, 12:30pm UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/8 "2017-12-15T12:30:29Z")

</div>

Maybe for clarification:

The Lookup is a Key-Value lookup. In your case could be the value a second column that just contains “true” or what ever indicate. Then you can lookup the IP in the ipaddr column and the value need to be read from a second column. Having the key and the value in the same is currently not supported by the csv lookup adapter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 29, 2017, 12:30pm UTC](https://community.graylog.org/t/reference-a-known-malicious-csv-list-of-i-p-addresses/3506/9 "2017-12-29T12:30:53Z")

</div>

Closed on December 29, 2017, 12:30pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.