topic Re: TAXII 2.1 Inputs (Without Splunk Enterprise Security) in Getting Data In

TAXII 2.1 Inputs (Without Splunk Enterprise Security)

himynamesdave — Mon, 20 Dec 2021 20:38:47 GMT

Hi all!

I know ES ships with a TAXII client to ingest threat intel over TAXII.

Does anything exist for users who do not have ES?

I am trying to ingest intel (in STIX 2.1) being distributed via a TAXII 2.1 server to Splunk.

Thanks!

Re: TAXII 2.1 Inputs (Without Splunk Enterprise Security)

PickleRick — Mon, 20 Dec 2021 22:48:42 GMT

You can always pull stix from taxii feed yourself using your favourite scripting/programming language and push results to splunk...

Re: TAXII 2.1 Inputs (Without Splunk Enterprise Security)

himynamesdave — Tue, 21 Dec 2021 17:50:46 GMT

Thanks, yep, understood @PickleRick

I was wondering if anything existed before building anything. e.g. https://splunkbase.splunk.com/app/2637/ for 2.x versions

I guess I'll take a deeper look at building something new then. Give this post an upvote if you're looking for something similar, and I'll bump it up in terms of my priorities.