Splunk ES documentation https://docs.splunk.com/Documentation/ES/7.1.1/Admin/Downloadthreatfeed#Add_a_URL-based_threat_sourc... describes how to Add a URL-based threat source and it seems work even with credential using POST. What if I have to use API Key instead of credentials? How to download Threat Intelligence from a remote API using API Keys? From MCAP https://mcap.cisecurity.org/ for instance.
Thank you for your time in advance.
Thank you, @meetmshah
"Cisco Threat Grid Add-On" is not exactly what I am looking for. My objective is to feed ES with the MCAP threat intelligence from https://mcap.cisecurity.org/ using its API key/token, if that possible.
Thank you for your response.
Hello @qq-stan, Have you checked https://splunkbase.splunk.com/app/4251 for MCAP?
