topic How do I test/check to see if my new "local" ES ThreatFeed is working? in Splunk Enterprise Security

How do I test/check to see if my new "local" ES ThreatFeed is working?

woodcock — Wed, 25 Dec 2024 19:46:28 GMT

I am using these dox:
https://docs.splunk.com/Documentation/ES/8.0.1/Admin/AddThreatIntelSources#Add_threat_intelligence_with_a_custom_lookup_file

It is pretty straightforward but I suspect that my configuraiton is not working. Where are the "master lookups" that Splunk's Threat Framework uses? I assume that there is 1 "master lookup" each for IPv4, domains, urls, hashes, etc. Or perhaps they are all combined into 1. There are about 100 lookups this client's ES and I have checked out the ones that look promising but didn't find my new data so I cannot conclude anything.

Re: How do I test/check to see if my new "local" ES ThreatFeed is working?

woodcock — Thu, 26 Dec 2024 15:39:27 GMT

I assume that this accepted answer is correct:
https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-the-threat-feed-I-added-using-threat-intelligence/m-p/234794

So like this:

| `service_intel` 
| `process_intel` 
| `file_intel` 
| `registry_intel` 
| `user_intel` 
| `email_intel` 
| `certificate_intel` 
| `ip_intel`

Re: How do I test/check to see if my new "local" ES ThreatFeed is working?

meetmshah — Thu, 26 Dec 2024 16:02:04 GMT

Yes, search for "_intel" in Lookup Definition and you will see all Threat Intel Lookup along with definition -

All lookups from the specific categories gets combined / merged and used to Threat Matching. For example, everything related to IP will fall under ip_intel lookup.

Please hit Karma, if this helps!