How to resolve Threat Artifacts report false posti...

Splunk Enterprise Security

An Example:
We have defined two malicious urls in the local_http_intel

This triggers false positives in the Threat Activity of ES on the valid and safe domain of github.com

How can we prevent / fix this?

Get Updates on the Splunk Community!

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

How to resolve Threat Artifacts report false postives in Threat Activity