Getting Data In

OTX/ET Rules import into Splunk

ddecker03
Loves-to-Learn Everything

So I am running SecurityOnion 16.04 and using Suricata/Zeek.

Suricata - ET Rules/Snort Rules
Zeek - AlienVault OTX.

I have read that other folks are ingesting the rule sets as a seperate index inside of Splunk (say one for OTX, and one for ET).

One how would I go about this, would I pull a new request from the say AlienVault OTX and build the index this way or try and just monitor the file created for the rules (for Zeek, its called bro_otx.dat (which looks to be a TSV file).

I tried to ingest the DAT file but it comes up as Binary.
Have not gotten around to try and ingest the Suricata Rules yet, they are in a file called download.rules

2nd question is there a good reason to ingest the rules seperate from what Zeek/Suricata reports on?

Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...