Does the ThreatConnect app require the Splunk Enterprise instance to have a Enterprise Security license in order to work?

[mtoups]

Does the ThreatConnect app require the Splunk Enterprise instance to have a Enterprise Security license in order to work?

[gsopkoTC · Accepted solution]

No, the ThreatConnect App for Splunk does not require either Splunk Enterprise Security nor a license for Splunk Enterprise Security.

[mtoups]

So when the Threatconnect app is used without the ES license, it will still allow IoCs to be matched against logs and alerts brought up?