Splunk Enterprise Security

How to add a PC name to a threat intel list for Splunk Enterprise Security?

evelenke
Contributor

Hi Splunkers,

We have an indicator of a phishing source from email headers - a PC name. We need to add it to a Threat Intel collection for ES.

I did not find an appropriate one to use. Should we create a custom list or would any of the pre-existing ollections work with it?

Labels (2)
0 Karma

alonsocaio
Contributor

Hi,

This PC name contains a domain or any related information? If so, maybe the "ip_intel" would fit your use case.

Also, in case you have not seen it yet, these are the supported types of threat intel in Enterprise Security: https://docs.splunk.com/Documentation/ES/6.1.1/Admin/Supportedthreatinteltypes

In my opinion, the only attention point in case you create a custom list is to validate if your active correlation searches and Threat Activity generating searches will be able to use this custom list.

One other option is to have this PC name in a IOC lookup file and create a custom search for correlating the lookup and your log sources.

evelenke
Contributor

Hi alonsocaio,

thank you for reply.
This is just a local name without any domain.
To be honest I did not examine all correlation searches on methods them correlate with intel tables, hence my question was brought up.
Also I'm in doubt it can compare lists with untypical field (not src, ip, user or other CIM-described field) .
So the idea with custom search that will parse data for a equality looks more appropriate to me as well.

0 Karma

alonsocaio
Contributor

Sure, if you want to take a further look on the Threat Activity rule works on Splunk ES, search for the Saved Searches ending with "Threat Gen", on the DA-ESS-ThreatIntelligence context.

I guess you would even be able to create a Threat Gen search for your custom list, but maybe a simplified approach would be better and faster, such as the lookup file for matching your logs.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...