Hello there,
The way this integration works is based on a straight-forward IOC pull method, meaning that Splunk ES has a framework to consume enriched IOC lists (Configure > Data Enrichment > Threat Intelligence Download), while on IntSights' side, the TIP creates an active list of IOCs which are bundled and customized under the Automation function. A virtual appliance or a cloud communication method is available to generate the URL that Splunk will need to begin to consume the IOC data.
Please reach out to IntSights if you'd like additional information on this or other technology integrations: support@intsights.com
Regards,
Juan
IntSights Engineer
