Splunk Cloud Platform

Threat intelligence feeds

iherb_0718
Path Finder

I am subscribed to a 3rd party threat intelligence called Threatconnect.  I have the Threatconnect app for splunk installed on my search head. 

My question is in regards to tuning as I have done very little to none. Should I expect that the threat intelligence that is streaming in is being ran against the events in my environment automatically? Assuming the threat intelligence is CIM compliant, should I expect that my Enterprise Security will make a notable event if there is a match?

 

 

 

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

Threatconnect app is  designed to be able to work without ES, but also support feeding ES Threat Intelligence sources. If you setup ES to ingest these data, you will start getting notables.

You can also setup searches to be alerted but since you already have ES, you can choose best suitable method.

You can find information about ingesting threat intelligence data to ES, or setting up searches against your events.

 https://training.threatconnect.com/learn/article/threatconnect-application-for-splunk-user-guide-kb-...

 

If this reply helps you, an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

Threatconnect app is  designed to be able to work without ES, but also support feeding ES Threat Intelligence sources. If you setup ES to ingest these data, you will start getting notables.

You can also setup searches to be alerted but since you already have ES, you can choose best suitable method.

You can find information about ingesting threat intelligence data to ES, or setting up searches against your events.

 https://training.threatconnect.com/learn/article/threatconnect-application-for-splunk-user-guide-kb-...

 

If this reply helps you, an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...