How to "clean up" Splunk Enterprise Security Threat Intelligence lists to remove obsolete entries?

[DMohn]

Hi Splunkers,

We have a running Enterprise Security environment with several Threat Intelligence downloads enabled. To our experience the threat lists downloaded are additive - hence the internal TI lists keep on growing, and obsolete entries are not removed. Now we experienced a case, where a once blacklisted IP range in the Akamai CDN is now used by the customer's CDN, and all traffic to this IP range is deemed malicious and reported in Splunk ESS.

So my questions are:
1) How can we (selectively) clean up the Threat Intelligence lists? Is there a chance to include only the current Threat IPs in the Threat Intelligence store?

2) Is there a way to whitelist IPs (IP ranges) so they won't appear in the Enterprise Security Threat Intelligence Lists?

Any hints are highly appreciated!

Cheers
Dennis

[stefanhutchison · Accepted solution]

This is controlled by a setting under the "Threat Intelligence Download Settings" within ES. You can set the "Maximum age" for each threat intelligence feed so that data ages out once it is stale.

Hope this helps!

[kausar]

If nothing is set, does this mean that it is unlimited or is there any default max age?

[aqtran82]

Apparently that feature for setting the Maximum Age is available on newer versions of ES. Is there another way to do this for older versions ? 3.3.x ?