Hi Splunkers.
I've manually uploaded a STIX file into ES.
The file has uploaded successfully (file can be seen in /opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/lookups) but I am unable to verify that the artifacts from the file have been integrated into ES Threat Intel.
In ES, Security Intelligence -> Threat Artifacts, I don't see artifacts from the file showing up when a search is done.
i.e. files, domains etc.
Additionally, these artifacts do not appear in relative consolidated lookup files i.e. threatintel_by_(domain|process|cidr) etc.,
Items from existing configured threat intel downloads do show up in ES threat artifacts as well as the lookup files.
**Am I assuming correctly that artifacts from ad-hoc uploads show up alongside those from scheduled intel downloads and do not get processed differently?
Unless I'm missing something, this indicates the integration of the artifacts from the STIX file into the consolidated has not taken place.
**Are there any other places to look to debug why the STIXX file integration into the threat intel lookup files is not happening?
Thanks.
