Splunk Enterprise Security

How to integrate the Threat intelligence feeds from ThreatConnect App for Splunk Enterprise into the Splunk Enteprise Security app?

anandhim
Path Finder

Hi,

There is an app for threat connect (https://splunkbase.splunk.com/app/1893/ ), but it does not integrate into Splunk Enterprise Security out of the box. Has anyone managed to integrate the Threat intelligence feeds from Threat Connect into Splunk ES?

Since ES already does the work for matching incoming data against the Threat intelligence feeds, I would like to be able to avoid having to install 2 splunk apps and just use ES to gain most value from both ES and Threat Connect.

0 Karma

mcronkrite
Splunk Employee
Splunk Employee

ES is not supported when other apps are installed.
So you will want to avoid adding any non-Splunk Certified app add-ons to the ES installation.

That being said, you can download the ThreatConnect integration and inspect the app for content that might want to add.

In the latest versions of ES, the threat intelligence setup is a wizard that you go through. What you want to do is find what data feed source the Threat Connect app looks at and mirror that in your own configuration by Configuring a Threat list in ES.

Check out how to do that here.
http://docs.splunk.com/Documentation/ES/3.3.0/Install/Configureblocklists

TL:DR; don't install a new app e.g. 1893, instead look at the app configs to find out the threat feed source and use the above url to set it up in ES.

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...