Getting Data In

remove custom csv file of threat intellignance

riqbal47010
Path Finder

hi

I uploaded custom csv file containing IP addresses.
Referring link "https://docs.splunk.com/Documentation/ES/latest/API/ThreatIntelligenceAPIreference". I have to remove data rows one by one.
there are 400 Ip's against that IP.

So I have to execute this command 400 times ?
PR there is some other way to remove these feeds from threat intelligance KV store.

0 Karma

harsmarvania57
Ultra Champion
0 Karma

riqbal47010
Path Finder

sorry still my problem not solved.

Still the "threat activity detected" is triggering against custom uploaded csv file.

However when I give below command
| inputlookup ip_intel | search threat_key="abc"

I am not seeing any feed datas when I do

and under threat activity dashboard I can see that the custom csv upload threat feed is still ative against
most active threat sources

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...