Splunk Enterprise Security

How to remove the unwanted threat group and threat category list from the dropdown of the threat activity feed? And also how to remove the data from ip_intel list ?

renjujacob88
Path Finder

HI Splunkers,

In our environment, We have couple of unwanted threat groups and threat category list populated in the drop downs present in the security intelligence threat activity. How to remove them. Please find the screenshot below for the reference

alt text

Just wanted to remove "F" from the threat Group and "undefined" From the threat Category dropdowns.
Also F group has threat feeds added to ip_intel lookup. How to flush data related to certain threat_key?

Need your help

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!