Splunk Enterprise Security: How are alerts added t...

panovattack · ‎11-05-2015

How are the threat gen reports/alerts in the DA-ESS Application collected on the threat_activity index? I would like to craft my own alert. I don't always want to generate a notable event, so a standard correlation search is not appropriate.

davpx · ‎01-25-2018

These are written using various HTTP calls to online threat lists. You could populate any index with collect or lookup with outputlookup

Splunk Enterprise Security: How are alerts added to the threat activity index? I would like to make my own 'Threat Gen' report/alert

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community

Are you a member of the Splunk Community?

Splunk Enterprise Security: How are alerts added to the threat activity index? I would like to make my own 'Threat Gen' report/alert

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

Data Persistence in the OpenTelemetry Collector

Thanks for the Memories! Splunk University, .conf25, and our Community