topic Re: threat intelligence in Splunk Enterprise Security

threat intelligence

mohad — Sun, 07 Jan 2024 13:13:59 GMT

I am subscribed to a 3rd party threat intelligence called Group-IB. I have the Group-IBapp for splunk installed on my search head.

My question is in regards to tuning as I have done very little to none. Should I expect that the threat intelligence that is streaming in is being ran against the events in my environment automatically? Assuming the threat intelligence is CIM compliant, should I expect that my Enterprise Security will make a notable event if there is a match?

Re: threat intelligence

aholzel — Wed, 10 Jan 2024 09:58:24 GMT

Should I expect that the threat intelligence that is streaming in is being ran against the events in my environment automatically?

I would not expect that, most vendors don't intergrade with the Splunk ES threat intel framework they just make the TI data available in Splunk via a lookup file or by putting it in a index. If you want to be sure the TI info is flowing into the threat intel framework I suggest you add the data there either by revering to the app created lookup (if any), by creating your own lookup from the indexed data or by adding a TAXII/STIX feed.

See for more info:
Splunk Latern
Splunk Docs

Re: threat intelligence

mohad — Thu, 11 Jan 2024 11:15:54 GMT

thank you for your help

can you help in how to create my own lookup from the indexed IT

Thanks