topic Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup? in Splunk Enterprise Security

Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

Olivier44 — Tue, 12 Jul 2016 12:02:32 GMT

Hello,

I added a new threat intelligence source in Splunk Enterprise Security (https://ransomwaretracker.abuse.ch/feeds/csv/ ). The download works fine and the list is stored in /opt/splunk/etc/aps/SA-TreatIntelligence/local/data. Then the list is included in the threat collection 'ip_intel' but at this step, I lose important information which is in the list, but not in the collection.

So I would like to use the downloaded list as a lookup. I tried to create a lookup in SA-ThreatIntelligence/lookpus/ and modified some parameters, but no data is copied in.

Any idea on how to do that?

PS: I am using Splunk 6.2.4 and ES 3.3.2

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

aholzel — Thu, 14 Jul 2016 09:10:47 GMT

I think the info you miss is in an other intel list you can try the all_threat_intel macro to see if you can find the info you are looking for. In the column threat_collection you can find list/macro that the info is in.

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

Olivier44 — Tue, 29 Sep 2020 10:16:01 GMT

I already used the all_threat_intel macro but I miss information too. The list I download has 9 fields and I need them all. (Firstseen (UTC),Threat,Malware,Host,URL,Status,Registrar,IP address(es),ASN(s),Country)

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

kerryc — Thu, 05 Jan 2017 14:20:32 GMT

Hi Oliver, did you ever get round to solving this?

I'm having the same issue with http://ransomwaretracker.abuse.ch/feeds/csv/

I've tried renaming the fields using regex and the field transforms, but no luck so far!

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

Olivier44 — Fri, 06 Jan 2017 10:18:41 GMT

Hello, I have not resolved this issue. I am still in the same version of Splunk but may be it is better in the last versions...

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

vinod50rao — Mon, 15 May 2017 02:02:02 GMT

Hi Team,

I'm using Enterprise splunk and trying to use the inbuilt threat intel feeds in splunk, let say iblocklist_tor, i have enabled it and it is getting downloaded at path location opt/splunk/etc/aps/SA-TreatIntelligence/local/data. But while i'm doing the lookup for it i'm not able to do it with my firewall logs getting no hits, what i'm trying is

index=firewall[| inputlookup iblocklist_tor.csv]

but not getting any result, the csv getting generated having delimiter as (:). can you please help me out with this hot wot get this done.

Thanks!
Vinod Yadav,Hi Team,

I'm also using splunk enterprise, i have enabled few in built threat intel source,let say iblocklist_tor. I'm seeing the file is getting downloaded with a delimiter as(:). How can i lookup the list of IP addresses in my firewall logs.

I'm trying to search like

index=firewall[| inputlookup iblocklist_tor.csv]

but not getting any event hit. can you please help me out with the steps what i'm missing here.

Thanks!
Vinod Yadav

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

vinod50rao — Mon, 15 May 2017 02:02:40 GMT

Hi Team,

index=firewall[| inputlookup iblocklist_tor.csv]

but not getting any result, the csv getting generated having delimiter as (:). can you please help me out with this hot wot get this done.

Thanks!
Vinod Yadav

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

woodcock — Sat, 21 Dec 2024 16:59:56 GMT

This should help:
https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Useintelinsearch

Re: Splunk Enterprise Security: How to use a downloaded threat intelligence source as a lookup?

woodcock — Mon, 23 Dec 2024 03:02:27 GMT

There is an app for this, too:
https://splunkbase.splunk.com/app/635