topic Re: Splunk buildin intelligence feed in Splunk Enterprise Security

Splunk buildin intelligence feed

hariskhan — Thu, 08 Aug 2019 13:59:58 GMT

Dear Splunkers,

Does Splunk enterprise security come with any threat intelligence feed that is solely provided by Splunk?.

Or does Splunk provide any threat intelligence feed?.

Re: Splunk buildin intelligence feed

lakshman239 — Thu, 08 Aug 2019 15:14:20 GMT

Yes, Splunk comes with threat intel and also allows you to add your own. Look at step 1 and 2 in https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Addthreatintel

Re: Splunk buildin intelligence feed

spectrum2035 — Wed, 30 Sep 2020 01:40:16 GMT

Hi lakshman,

We receive Phishing attack feeds (which we need to manually upload every week) and i am planning to use email_intel as the threat feed. But we have the following header fields Bitcoin address, File names, Terminated Process and Email Subject etc.

For email_intel as per Splunk, we need to use description,src_user,subject,weight.

Is it okay to create this a email_intel or do i have to use a different one?

Re: Splunk buildin intelligence feed

hariskhan — Thu, 08 Aug 2019 17:29:07 GMT

Thanks brother for prompt response.

Re: Splunk buildin intelligence feed

smoir_splunk — Thu, 08 Aug 2019 22:15:03 GMT

Please do not accept your own answer. Accept Lakshman's answer, so that he gets awarded the karma for correctly answering your question. Thank you!

Re: Splunk buildin intelligence feed

smoir_splunk — Thu, 08 Aug 2019 22:15:42 GMT

Splunk Enterprise Security includes connections to open source threat intelligence feeds, but it is not a threat intelligence collector/provider like an ISAC might be, or like VERIS or Facebook Threat Exchange. It allows you to aggregate threat intelligence, but Splunk the company does not collect any as a service.