Splunk Enterprise Security

Splunk Enterprise Security: Can you explain more about the configuration for Threat Intelligence?

test_qweqwe
Builder

We have this config:

[threatlist://ransomware_ip_blocklist]
delim_regex = :
description = abuse.ch Ransomware Blocklist
disabled = false
fields = ip:$1,description:Ransomware_ip_blocklist
type = threatlist
url = https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt

Why we wrote there $1? What it's mean? (Yes, it's mean IP, it's regular that will pars all IP?

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

$1 is the value for the ip field. Refer to documentation here : http://docs.splunk.com/Documentation/ES/4.7.3/Admin/Downloadthreatfeed

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

$1 is the value for the ip field. Refer to documentation here : http://docs.splunk.com/Documentation/ES/4.7.3/Admin/Downloadthreatfeed

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...