Splunk Enterprise Security

How to "clean up" Splunk Enterprise Security Threat Intelligence lists to remove obsolete entries?

DMohn
Motivator

Hi Splunkers,

We have a running Enterprise Security environment with several Threat Intelligence downloads enabled. To our experience the threat lists downloaded are additive - hence the internal TI lists keep on growing, and obsolete entries are not removed. Now we experienced a case, where a once blacklisted IP range in the Akamai CDN is now used by the customer's CDN, and all traffic to this IP range is deemed malicious and reported in Splunk ESS.

So my questions are:
1) How can we (selectively) clean up the Threat Intelligence lists? Is there a chance to include only the current Threat IPs in the Threat Intelligence store?

2) Is there a way to whitelist IPs (IP ranges) so they won't appear in the Enterprise Security Threat Intelligence Lists?

Any hints are highly appreciated!

Cheers
Dennis

1 Solution

stefanhutchison
Explorer

This is controlled by a setting under the "Threat Intelligence Download Settings" within ES. You can set the "Maximum age" for each threat intelligence feed so that data ages out once it is stale.

Hope this helps!

View solution in original post

stefanhutchison
Explorer

This is controlled by a setting under the "Threat Intelligence Download Settings" within ES. You can set the "Maximum age" for each threat intelligence feed so that data ages out once it is stale.

Hope this helps!

kausar
Path Finder

If nothing is set, does this mean that it is unlimited or is there any default max age?

0 Karma

aqtran82
New Member

Apparently that feature for setting the Maximum Age is available on newer versions of ES. Is there another way to do this for older versions ? 3.3.x ?

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...