https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252426#M1823 <P>Is there a way to use lookups to add threat intelligence to the non-network based intelligence stores, such as file_intel? I know STIX and OpenIOC can populate these, however, I've got IOCs in CSVs and custom feeds of file names, hashes, etc. Thanks!</P> Sat, 28 Nov 2015 02:21:09 GMT panovattack 2015-11-28T02:21:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252426#M1823 <P>Is there a way to use lookups to add threat intelligence to the non-network based intelligence stores, such as file_intel? I know STIX and OpenIOC can populate these, however, I've got IOCs in CSVs and custom feeds of file names, hashes, etc. Thanks!</P> Sat, 28 Nov 2015 02:21:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252426#M1823 panovattack 2015-11-28T02:21:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252427#M1824 <P>Yes absolutely, in fact, that's the default threat list style. <BR /> The csv files have to have two fields, ip and description, url and description, or domain and description.</P> <P><A href="http://docs.splunk.com/Documentation/ES/3.3.0/Install/Configureblocklists">http://docs.splunk.com/Documentation/ES/3.3.0/Install/Configureblocklists</A></P> Sat, 28 Nov 2015 15:47:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252427#M1824 mcronkrite 2015-11-28T15:47:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252428#M1825 <P>I've followed the instructions in the documentation for network indicators (IPs, URLs, and Domains) and it work great! However, I can not reproduce those results for fie-based indicators (file names, hashes, etc.). </P> Sat, 28 Nov 2015 16:31:57 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252428#M1825 panovattack 2015-11-28T16:31:57Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252429#M1826 <P>fixed in updates of ES</P> Sun, 26 Feb 2017 14:47:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Add-intelligence-to-file-intel/m-p/252429#M1826 panovattack 2017-02-26T14:47:54Z