Splunk Enterprise Security

Question about improvments regarding IoC in Threat Intel collection

d4wc3k
Path Finder

Hello All on Forum

I have following problem with threat intel in Splunk ES.
I have got IoC, which is IP address and it has been placed in ip_intel.
This triggered alert where ioc IP reached some my external IP on 80 dst port ( It looks like someone accessed my company web-page)
Based on description of malware associated with IoC, It's not threat, risky situation should be in other direction, when my machine tried reach url with this IP.
My question is:
Should I move IP to http_intel collection when I am aware of context ?

I would like ask you also about good practices regarding organizing threat_intel collections.
Should I create more correlation searches, which will cover particular threat or just use one for threat_intel things?

Thanks a lot ans sorry for bad English.
BR
Dawid

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...