Optiv_TA_threat: Do I need to schedule the starter_script.sh to run via a cron job to update the data in the Optiv index?

[Kieffer87]

Do I need to schedule the starter_script.sh to run via a cron job to update the data in the Optiv index? I didn't see anything about it in the readme nor in the GUI.

Thanks.

[BenTan · Accepted solution]

Hi Kieffer87,

From my understanding and experience using the Optiv Threat Intel App, the script is scheduled to run every 6 hours (4 times a day) at specific intervals to pull new data from the threat intelligence databases.

So I don't think you need to do a custom cron job to schedule it again. Just run the script once and it will update on its own.

Regards,
Benjamin

[klaxdal]

Keiffer87

I have installed this app on both WINX64 and Centos - each time I simply edited the .py files to point to the appropriate Splunk dir e.g. on windows the drive with the Splunk install ( C:\ or D:\ etc. ) and run either starter_script.sh or the .bat via the command line . I have only had to run it once .

KL