Splunk Enterprise Security

Question about improvments regarding IoC in Threat Intel collection

d4wc3k
Path Finder

Hello All on Forum

I have following problem with threat intel in Splunk ES.
I have got IoC, which is IP address and it has been placed in ip_intel.
This triggered alert where ioc IP reached some my external IP on 80 dst port ( It looks like someone accessed my company web-page)
Based on description of malware associated with IoC, It's not threat, risky situation should be in other direction, when my machine tried reach url with this IP.
My question is:
Should I move IP to http_intel collection when I am aware of context ?

I would like ask you also about good practices regarding organizing threat_intel collections.
Should I create more correlation searches, which will cover particular threat or just use one for threat_intel things?

Thanks a lot ans sorry for bad English.
BR
Dawid

0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...