Splunk Enterprise Security
Highlighted

How to "clean up" Splunk Enterprise Security Threat Intelligence lists to remove obsolete entries?

Motivator

Hi Splunkers,

We have a running Enterprise Security environment with several Threat Intelligence downloads enabled. To our experience the threat lists downloaded are additive - hence the internal TI lists keep on growing, and obsolete entries are not removed. Now we experienced a case, where a once blacklisted IP range in the Akamai CDN is now used by the customer's CDN, and all traffic to this IP range is deemed malicious and reported in Splunk ESS.

So my questions are:
1) How can we (selectively) clean up the Threat Intelligence lists? Is there a chance to include only the current Threat IPs in the Threat Intelligence store?

2) Is there a way to whitelist IPs (IP ranges) so they won't appear in the Enterprise Security Threat Intelligence Lists?

Any hints are highly appreciated!

Cheers
Dennis

Highlighted

Re: How to "clean up" Splunk Enterprise Security Threat Intelligence lists to remove obsolete entries?

This is controlled by a setting under the "Threat Intelligence Download Settings" within ES. You can set the "Maximum age" for each threat intelligence feed so that data ages out once it is stale.

Hope this helps!

View solution in original post

Highlighted

Re: How to "clean up" Splunk Enterprise Security Threat Intelligence lists to remove obsolete entries?

New Member

Apparently that feature for setting the Maximum Age is available on newer versions of ES. Is there another way to do this for older versions ? 3.3.x ?

0 Karma
Highlighted

Re: How to "clean up" Splunk Enterprise Security Threat Intelligence lists to remove obsolete entries?

Path Finder

If nothing is set, does this mean that it is unlimited or is there any default max age?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.