Getting Data In

TAXII 2.1 Inputs (Without Splunk Enterprise Security)

himynamesdave
Contributor

Hi all!

I know ES ships with a TAXII client to ingest threat intel over TAXII.

Does anything exist for users who do not have ES?

I am trying to ingest intel (in STIX 2.1) being distributed via a TAXII 2.1 server to Splunk.

Thanks!

Labels (1)
0 Karma

himynamesdave
Contributor

Thanks, yep, understood @PickleRick 

I was wondering if anything existed before building anything. e.g. https://splunkbase.splunk.com/app/2637/ for 2.x versions

I guess I'll take a deeper look at building something new then. Give this post an upvote if you're looking for something similar, and I'll bump it up in terms of my priorities. 

0 Karma

PickleRick
Ultra Champion

You can always pull stix from taxii feed yourself using your favourite scripting/programming language and push results to splunk...

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...