Splunk Enterprise Security

DNS query in threat intelligence of Enterprise Security

rossikwan
Path Finder

Hi,

Configured the proxy for retrieving threat intelligence in Enterprise Security and its succesfully retrieved those feed.

As the local Splunk server DNS query will be stopped for external Internet name query soon, I am in doubt that the retrival of the threat intelligence will be failed as the Enterprise Security can't have the DNS query results from the proxy server.

Will it need to keep the local Splunk server have the external DNS query in order to have the retrieving threat intelligence succesful?

0 Karma

harsmarvania57
Ultra Champion

Hi,

As you are downloading threat feed via proxy, it is not required for Splunk Server to have external DNS access, proxy will resolve those DNS queries and serve the request.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...