Splunk Enterprise Security

ES Search query

So76
Explorer

Hey, has anyone created a search that merges an ipadd from threat intel and ipadd from azure so it'll trigger an alert if there's a match. Don't know if it's possible. Thanks, will appreciate any help or advise. I am new to ES

 

Labels (1)

ro_mc
Path Finder

Good news! The threat intelligence framework does all the hard work for you.

The following link provides an overview of the process, but the main point is that there's a correlation search called "Threat Activity Detected".

https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/threatintelligenceframework/

To configure alerts based on threat intelligence, open Splunk Enterprise Security, click on Content Management, and select a Type of "correlation search". Locate the "Threat Activity Detected" correlation search and enable the search.

By default, the search will run at 10 minutes past each hour and look for threats over the last 65 minutes. Once detected, threat matches will not be reported for another 24 hours.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...