Splunk Enterprise Security

How to view data from Threat intel collections?

neerajs_81
Builder

Hello, Like any other ES user, we have threat intel feeds configured that came along with box.  How can i view the actual data of this threat intel feed ?  

For example:   Lets take the cisco_top_one_million_sites OR  emerging_threats_ip_blocklist  sources.

neerajs_81_0-1659069546287.png

All of these 4 commands error out.   Well,  how can i find what is being downloaded ? How to view these collection s ?

| inputintelligence emerging_threats_ip_blocklist
OR
| inputlookup emerging_threats_ip_blocklist
OR
| inputintelligence cisco_top_one_million_sites
OR 
| inputlookup cisco_top_one_million_sites

 

Labels (1)
0 Karma

xeaon
Explorer

Hey! There is a dashboard for all your threat artifacts in

Security Intelligence -> Threat Intelligence -> Threat Artifacts

 

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...