Splunk Enterprise Security

How to update an existing threat intel collection row on splunk ESS portal?

StanD3sec
Loves-to-Learn

I can CRUD threat intel collection rows with ESS REST API(such as /services/data/threat_intel/item/ip_intel), and I can see those rows at Security Intelligence->Threat Intelligence->Threat Artifacts. 

StanD3sec_2-1630710567766.png

 

StanD3sec_0-1630710488847.png

 

May I know how I can do the same job on Splunk ESS portal? As I can only update local lookup files via Configure > Content > Content Management, and insert a row above/below, but it looks different from what I do with REST API, and I cannot get the rows I added with API there. 

StanD3sec_1-1630710512664.png

 

Besides, I cannot find the row I inserted to local lookup file at Security Intelligence->Threat Intelligence->Threat Artifacts.

May I know if I missed something during configuration or there is elsewhere on ESS portal that I can update threat intel rows?

Thanks

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...