Getting Data In

OTX/ET Rules import into Splunk

ddecker03
Loves-to-Learn Everything

So I am running SecurityOnion 16.04 and using Suricata/Zeek.

Suricata - ET Rules/Snort Rules
Zeek - AlienVault OTX.

I have read that other folks are ingesting the rule sets as a seperate index inside of Splunk (say one for OTX, and one for ET).

One how would I go about this, would I pull a new request from the say AlienVault OTX and build the index this way or try and just monitor the file created for the rules (for Zeek, its called bro_otx.dat (which looks to be a TSV file).

I tried to ingest the DAT file but it comes up as Binary.
Have not gotten around to try and ingest the Suricata Rules yet, they are in a file called download.rules

2nd question is there a good reason to ingest the rules seperate from what Zeek/Suricata reports on?

Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...