Splunk Enterprise Security

PhishTank Threat Intelligence Not Writing to Collection

merzinger_prude
Explorer

I am trying to enable the out of box PhishTank Threat Intelligence in ES. The file downloads correctly but it doesn't write to any KV store collection. From my understanding, it should write to one of the *_intel KV stores. What else do I need to configure?

1 Solution

merzinger_prude
Explorer

Thanks jawaharas,

I am not able to view the image you posted.

View solution in original post

0 Karma

merzinger_prude
Explorer

Thanks jawaharas,

I am not able to view the image you posted.

0 Karma

jawaharas
Motivator

Avoid posting your response/query as new answer. Instead user 'Add Comment' option under corresponding post.

Text version of Parsing options:

Parsing Options-
Demiliting regular expression: ,
Extracting reguarl expression:
Fields: url:$2,description:"Target: $8 (xref: $3)"
Ignoring regular expression: (^#|^\s*$)
Skip header lines: 1
Intelligence file encoding:

0 Karma

jawaharas
Motivator

@merzinger_prudent
Can you upvote and accept the answer if it's helped you? Thanks.

0 Karma

merzinger_prude
Explorer

Thanks for your help. That worked

0 Karma

jawaharas
Motivator

Parsing options for 'phishtank' intelligence downloads:

parsing options for 'phishtank' intelligence downloads

Can you accept the answer if it's helped you? Thanks.

0 Karma

merzinger_prude
Explorer

Thanks for your reply. I see the file being downloaded daily to$SPLUNK_BASE/etc/apps/SA-ThreatIntelligence/local/data/threat_intel/phishtank.csv, however the "threat_group_intel" lookup is empty. Could this be a parsing issue? What should the settings be for Parsing Options under Data Inputs>Intelligence Downloads>phishtank?

0 Karma

jawaharas
Motivator

The 'phishttank' intel data is collected in 'threat_group_intel' kvstore collection.

You can verify the audit events to ensure the threat intelligences are collected by navigating to: Audit -> Threat Intelligence Audit in the ESS app menu.

Also, can you see data in '$SPLUNK_BASE/etc/apps/SA-ThreatIntelligence/local/data/threat_intel/phishtank.csv' file?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...