Splunk Cloud Platform

Threat intelligence feeds

iherb_0718
Path Finder

I am subscribed to a 3rd party threat intelligence called Threatconnect.  I have the Threatconnect app for splunk installed on my search head. 

My question is in regards to tuning as I have done very little to none. Should I expect that the threat intelligence that is streaming in is being ran against the events in my environment automatically? Assuming the threat intelligence is CIM compliant, should I expect that my Enterprise Security will make a notable event if there is a match?

 

 

 

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

Threatconnect app is  designed to be able to work without ES, but also support feeding ES Threat Intelligence sources. If you setup ES to ingest these data, you will start getting notables.

You can also setup searches to be alerted but since you already have ES, you can choose best suitable method.

You can find information about ingesting threat intelligence data to ES, or setting up searches against your events.

 https://training.threatconnect.com/learn/article/threatconnect-application-for-splunk-user-guide-kb-...

 

If this reply helps you, an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @iherb_0718,

Threatconnect app is  designed to be able to work without ES, but also support feeding ES Threat Intelligence sources. If you setup ES to ingest these data, you will start getting notables.

You can also setup searches to be alerted but since you already have ES, you can choose best suitable method.

You can find information about ingesting threat intelligence data to ES, or setting up searches against your events.

 https://training.threatconnect.com/learn/article/threatconnect-application-for-splunk-user-guide-kb-...

 

If this reply helps you, an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...