Splunk Enterprise Security

Splunk ES taxii feed - AlienVault OTX config

oz_dg
Explorer

Hi everyone,

Am having issues with the configuration of the AlienVault OTX feed in Splunk ES and would appreciate any help.

Have got my AlienVault OTX key ready but need help with the Threat Intel taxii feed settings in the web gui.

Data inputs » Intelligence Downloads »

Type: taxii

URL: https://otx.alienvault.com/taxii/discovery
POST Arguments: <this is where my key should be placed but how is this formatted??>

-> have tried taxii_username="my_key"  in the post arguments to no avail. Just keep seeing the "TAXII feed polling starting" message on the "Threat Intelligence Audit" page.

Any help is greatly appreciated.

Cheers

Labels (2)

oz_dg
Explorer

Hoping that there is way forward with this one.

Many thanks in advance.

0 Karma

MaverickT
Communicator

My advice is to install Splunk Add-on for Open Threat Exchange and Supporting Add-on for Open Threat Exchange. The installation is pretty straight forward and configuration guide can be found in the Details section of each Add-on on splunkbase.

I've managed to install and configure those add-ons in less than an hour.

https://splunkbase.splunk.com/app/4336/

https://splunkbase.splunk.com/app/4337/

oz_dg
Explorer

Hi,

Many thanks for the reply.

We've been using those already but were kinda hoping we could move away from them (2yrs+ since last update on the github page + no SplunkApp Inspection pass mark) and use the general taxii feed input as it works fine for other feeds.

Cheers

efheem
Explorer

Just in case if someone is still looking for an answer to this, go to ES Threat Intelligence Management and click New ->TAXII

Url : https://otx.alienvault.com/taxii/collections

Post Arguments:

collection=user_AlienVault taxii_username=xxxxxxxxxxxxxyourAPIKeyHerexxxxxxxxx  taxii_password=foo


Cheers!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...