https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-with-threat-intel-data/m-p/419123#M5124 <P>Hi All,</P> <P>I am trying to build a use-case from the firewall logs wherein if any allowed traffic is observed from any Public IP towards the Network on suspicious ports like SSH, RDP etc , it should trigger an alert. Is there any way through which I can achieve the following through Enterprise security :</P> <OL> <LI><P>If there is allowed connection from any other IP other than the IP in threat intel , alert severity should be low. </P></LI> <LI><P>If there is allowed connection from threat intel IP, alert severity should be high.</P></LI> </OL> Tue, 04 Dec 2018 13:59:05 GMT samadmemon 2018-12-04T13:59:05Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-with-threat-intel-data/m-p/419123#M5124 <P>Hi All,</P> <P>I am trying to build a use-case from the firewall logs wherein if any allowed traffic is observed from any Public IP towards the Network on suspicious ports like SSH, RDP etc , it should trigger an alert. Is there any way through which I can achieve the following through Enterprise security :</P> <OL> <LI><P>If there is allowed connection from any other IP other than the IP in threat intel , alert severity should be low. </P></LI> <LI><P>If there is allowed connection from threat intel IP, alert severity should be high.</P></LI> </OL> Tue, 04 Dec 2018 13:59:05 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-with-threat-intel-data/m-p/419123#M5124 samadmemon 2018-12-04T13:59:05Z