Splunk Enterprise Security

Question about improvments regarding IoC in Threat Intel collection


Hello All on Forum

I have following problem with threat intel in Splunk ES.
I have got IoC, which is IP address and it has been placed in ip_intel.
This triggered alert where ioc IP reached some my external IP on 80 dst port ( It looks like someone accessed my company web-page)
Based on description of malware associated with IoC, It's not threat, risky situation should be in other direction, when my machine tried reach url with this IP.
My question is:
Should I move IP to http_intel collection when I am aware of context ?

I would like ask you also about good practices regarding organizing threat_intel collections.
Should I create more correlation searches, which will cover particular threat or just use one for threat_intel things?

Thanks a lot ans sorry for bad English.

0 Karma