Splunk Enterprise Security

Force Threat Intelligence download

matthewhintz
New Member

Greetings,

For ES, is there a way to force the threat intelligence feeds to download? I think they default run on a 12 hour schedule but would like to be able to force a download if necessary.

0 Karma
1 Solution

Azeemering
Builder

You can set the interval per Intelligence Download under Configure->Data Enrichment->Intelligence Downloads.
Here you can specify the interval per feed.
Default for most is 86400 seconds

View solution in original post

0 Karma

matthewhintz
New Member

I would prefer to be able to simply force it but it is as I suspected. I must change the update interval to something like 60 seconds and then change it back to what I want to run normally.

0 Karma

Azeemering
Builder

You can set the interval per Intelligence Download under Configure->Data Enrichment->Intelligence Downloads.
Here you can specify the interval per feed.
Default for most is 86400 seconds

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...