Splunk Enterprise Security

Enterprise Security Threat Intelligence - Lookup population?



I'm starting with ES Threat Intelligence and am wondering, how threat intel data is populated to the KV stores used in the correlation search "Threat Activity Detected".

As a simple example I manually added an entry to local_email_intel (which is of course enabled).
Now I'm expecting the email address to appear in the KV store threatintel_by_email, which is used in the threat matching search for email. But threatintel_by_email is still empty, although I waited for a while for background jobs. I can't find the entered email address in the Threat Artifacts dashboard as well.

What is my mistake here? What kind of background job do we need/wait for to make my entry available for threat detection?

Thanks in advance 🙂


Labels (1)
0 Karma


It looks like disabling and re-enabling the local_email_intel source via the management interface does the trick. But I don't think this should be the way to go 🙂

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...