How to create a correlation search based on data provided by SANS Threat Intelligence?

Kitag345 — Fri, 17 Feb 2023 17:56:57 GMT

Hello,

I would like to request guidance on how to create a correlation search based on data provided by SANS Threat Intelligence from https://isc.sans.edu/block.txt

The malicious IPs from "block.txt" are updated regularly. How can my correlation search track that change in real-time? What queries to use?

Notes: The SANS Threat Intel has already been enabled.

Re: Correlation search

nyc_jason — Fri, 17 Feb 2023 17:43:45 GMT

consider using the PAVO Getwatchlist add-on, then you can do this:

Or for performance, schedule the search every 30min, and pipe it to a lookup. then run your search using the lookup for matches.

topic Re: Correlation search in Splunk Search

How to create a correlation search based on data provided by SANS Threat Intelligence?

Re: Correlation search