Splunk Enterprise Security

How to parse API key to access URL (list) provided by threat intelligence service?

siddh01r
New Member

Hi there,

We now have a service that provides us with a threat intel list. However, if we need to access that URL, we need to parse an API key.

Can someone suggest how I could get this sorted?

Has someone previously done this?

Thanks.

0 Karma

PavelP
Motivator

Hello @siddh01r

first check on Splunkbase if there is an app/add-on for it: https://splunkbase.splunk.com/

Alternatevely, you can access external url using this app: https://splunkbase.splunk.com/app/4146/ written by @jkat54

siddh01r
New Member

Hi There,

Thanks for the recommendation. However, how will i use this app to connect back to my threat intel feed?

what it should do:
1. Use API to connect to external url to retrieve the threat intel feed.
2. intel feed gets downloaded in Splunk Enterprise Security

Thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...