Integration with IntSights Threat Intel Platform

silverf33 · ‎02-13-2019

How can I integrate IntSights Threat Intel Platform (TIP) with Splunk?

juancmarin · ‎02-14-2019

Hello there,

The way this integration works is based on a straight-forward IOC pull method, meaning that Splunk ES has a framework to consume enriched IOC lists (Configure > Data Enrichment > Threat Intelligence Download), while on IntSights' side, the TIP creates an active list of IOCs which are bundled and customized under the Automation function. A virtual appliance or a cloud communication method is available to generate the URL that Splunk will need to begin to consume the IOC data.

Please reach out to IntSights if you'd like additional information on this or other technology integrations: support@intsights.com

Regards,
Juan
IntSights Engineer

Integration with IntSights Threat Intel Platform

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Integration with IntSights Threat Intel Platform

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...