Splunk Enterprise Security

Splunk Enterprise Security: Do I need to create a new correlation search to use threat intelligence?

irsysintegratio
Path Finder

Hello,

We are researching on integration with Splunk Enterprise Security (ES), and I have a question about threat intelligence.

I added a CSV file for threat intelligence download, and I can see that the ip address stored in the CSV file has been extracted successfully and added to the threat intelligent artifacts. My question is how to use this newly added IOC? Do I need to create a new correlation research to use it? Or will it be used automatically by Splunk ES built-in correlation search?

Thanks!

jstoner_splunk
Splunk Employee
Splunk Employee

By default there is a correlation search that is pre-built into the system called Threat Activity Detected that can be turned on and run by default. You can modify it or create additional correlation searches if you would like.

0 Karma

irsysintegratio
Path Finder

The result of this pre-built correlation research is shown in the "Threat Activity Detected" dashboard? Somehow it does not work.
1. We added a simple CSV file with an IP address 10.122.25.51.
2. We verified that this IP address appears in the ip_intel. This means Splunk ES parsed the CSV file and extracted the IOC properly, right?
3. We verified that there are simulated active events with dest="10.122.25.51". But there is not notable event created. Threat Activity Detected dashboard does not show notable event caused by this IP address being detected.

Anything missing here? How can we debug this please?

Thanks!

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

The default correlation would show in threat activity dashboard as well as would generate a notable event provided the correlation search is enabled and configured. There is a bit of housekeeping that is performed to prepare the data. I would take a look at the threat gen saved searches within ES, specifically Threat - Source And Destination Matches - Threat Gen and take a look at the search interval and also the search to ensure it runs. You can also look at the threat activity data model data and see what is in there as this is where the correlation search looks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...