Hello All on Forum
I have following problem with threat intel in Splunk ES.
I have got IoC, which is IP address and it has been placed in ip_intel.
This triggered alert where ioc IP reached some my external IP on 80 dst port ( It looks like someone accessed my company web-page)
Based on description of malware associated with IoC, It's not threat, risky situation should be in other direction, when my machine tried reach url with this IP.
My question is:
Should I move IP to http_intel collection when I am aware of context ?
I would like ask you also about good practices regarding organizing threat_intel collections.
Should I create more correlation searches, which will cover particular threat or just use one for threat_intel things?
Thanks a lot ans sorry for bad English.
BR
Dawid
