Splunk Enterprise Security

Add intelligence to file_intel

panovattack
Communicator

Is there a way to use lookups to add threat intelligence to the non-network based intelligence stores, such as file_intel? I know STIX and OpenIOC can populate these, however, I've got IOCs in CSVs and custom feeds of file names, hashes, etc. Thanks!

0 Karma
1 Solution

mcronkrite
Splunk Employee
Splunk Employee

Yes absolutely, in fact, that's the default threat list style.
The csv files have to have two fields, ip and description, url and description, or domain and description.

http://docs.splunk.com/Documentation/ES/3.3.0/Install/Configureblocklists

View solution in original post

0 Karma

mcronkrite
Splunk Employee
Splunk Employee

Yes absolutely, in fact, that's the default threat list style.
The csv files have to have two fields, ip and description, url and description, or domain and description.

http://docs.splunk.com/Documentation/ES/3.3.0/Install/Configureblocklists

0 Karma

panovattack
Communicator

I've followed the instructions in the documentation for network indicators (IPs, URLs, and Domains) and it work great! However, I can not reproduce those results for fie-based indicators (file names, hashes, etc.).

0 Karma

panovattack
Communicator

fixed in updates of ES

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...