Splunk Enterprise Security

Splunk Enterprise Security: Can I use a dynamic threat intelligence CSV file as a lookup to compare with firewall IPs?

sumitkathpal
Explorer

Hi All,

Here is the scenario:

Currently we are using custom threat intelligence in Splunk Enterprise Security to download the CSV file (Threat Intelligence from internet) which gets downloaded in path C:\Program Files\Splunk\etc\apps\SA-ThreatIntelligence\local\data\threat_intel\ filename.csv and gets updated every 1 hour.

Now we need to use this filename.csv (which is dynamic file as it get automatically updated).

Can I use this dynamic file as a lookup to compare with firewall IP (If yes what are the steps to use the path mentioned above), as we are developing our app for threat intelligence? Or are there other options we can use?

Thanks in advance 🙂

Happy Splunking

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

You could use the entire threat framework to do this. Make sure the threat intel download settings are correctly pulling into the ip_intel threat collection. The key is making sure the fields value is configured correctly. If I had a comma delimited file with description, ip the fields value might look like ip:$2 and the delimiter is ,

Once the data comes in cleanly to threat artifacts the lookup gen and threat gen will handle the data just like the built in threat intel and the data gets correlated with all logs not just firewall. Additional refinement could then be done to limit to just firewall.

There are other ways to solve it but this can leverage all the development that is already in place.

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

Hi

have you seen/followed this link http://docs.splunk.com/Documentation/ES/4.5.1/User/Configureblocklists
specifically the "Adding a custom source", choosing a ip type

and yes, you can use it as a lookup, in ES dashboard, ...

0 Karma

sumitkathpal
Explorer

Any update guys ........................................

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...