Splunk Enterprise Security

Manually Download and Import Threat intelligence Update for Splunk Enterprise Security

JohnEGones
Communicator

Hi all,

Was wondering if there was a way to manually grab the threat intelligence updates for Splunk ES (we are on 7.3.1.)

Specifically:  Intelligence download of "mitre_attack" - threatlist download

Our Splunk environment is on-prem and air-gapped, so there is not really any way to create an external connection to the internet.

Any ideas or advice would be appreciated.

Labels (1)
0 Karma

JohnEGones
Communicator

Hi scelikok,

Thanks, that is a possible solution but not one feasible right now, partly because as you say it is expensive.

I am working on testing the manual download, a conversion to CSV and then upload to ES. I will update this post with my results.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @JohnEGones ,

Although an expensive solution, you can use sandbox and data diode for sending threat intel files into the air gapped network. 

Download the files using internet connected system, after sandbox scanning you can send the file to protected network through a strictly configured one way data diode. Lastly you can update ES threat list by serving this file with a simple web server.

 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...