Good news! The threat intelligence framework does all the hard work for you.
The following link provides an overview of the process, but the main point is that there's a correlation search called "Threat Activity Detected".
https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/threatintelligenceframework/
To configure alerts based on threat intelligence, open Splunk Enterprise Security, click on Content Management, and select a Type of "correlation search". Locate the "Threat Activity Detected" correlation search and enable the search.
By default, the search will run at 10 minutes past each hour and look for threats over the last 65 minutes. Once detected, threat matches will not be reported for another 24 hours.
