How to integrate the Threat intelligence feeds from ThreatConnect App for Splunk Enterprise into the Splunk Enteprise Security app?

[anandhim]

Hi,

There is an app for threat connect (https://splunkbase.splunk.com/app/1893/ ), but it does not integrate into Splunk Enterprise Security out of the box. Has anyone managed to integrate the Threat intelligence feeds from Threat Connect into Splunk ES?

Since ES already does the work for matching incoming data against the Threat intelligence feeds, I would like to be able to avoid having to install 2 splunk apps and just use ES to gain most value from both ES and Threat Connect.

[mcronkrite]

ES is not supported when other apps are installed.
So you will want to avoid adding any non-Splunk Certified app add-ons to the ES installation.

That being said, you can download the ThreatConnect integration and inspect the app for content that might want to add.

In the latest versions of ES, the threat intelligence setup is a wizard that you go through. What you want to do is find what data feed source the Threat Connect app looks at and mirror that in your own configuration by Configuring a Threat list in ES.

Check out how to do that here.
http://docs.splunk.com/Documentation/ES/3.3.0/Install/Configureblocklists

TL:DR; don't install a new app e.g. 1893, instead look at the app configs to find out the threat feed source and use the above url to set it up in ES.