Brand Alert API Splunk application tutorial

WhoisXML Brand Alert API is an application for Splunk. It allows to search across all recently registered & deleted domain names and returns result sets consisting of domain names that contain term(s) that are specified by you within Splunk.

Prerequisites

You need to have Splunk Enterprise installed and configured. To do so, please refer to the official documentation.

Configuring the extension

1. Log in to Splunk.

2. Download and install the application. This can be done from within Splunk. (https://splunkbase.splunk.com/app/5127)

3. You can start configuring immediately once the application is installed.

3.1 You can also configure the application on the Apps page. Click on Set up next to the application name.

4. Fill in your API key and click on Save.

Using the extension

1. On the Brand Alert API lookup page you can perform instant brand alert lookups.

2. To integrate Brand Alert lookup into your script you can use the command wxabrandalert. It takes up to 10 arguments: include_term1, … include_term4 where you provide search terms which should be included, exclude_term1, … exclude_term4 where you provide search terms which should be excluded, api_key (optional), where you can provide your API key, otherwise it will be taken from a config file, and since_date (optional), which should be a date from the range (Today – 14 days, yesterday]. This date should be in YYYY-MM-DD format.