Splunk Enterprise Security

Splunk Enterprise Security: How to remove threat intelligence feeds from Threat Intelligence Downloads section?

jamesatwork703
Engager

Is there a way to remove threat intelligence feeds from the 'Threat Intelligence Downloads' section? I know I can disable them, but I'd rather get rid of them all together so it's cleaner and easier to read/navigate.

Thanks in advance.

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

The bulk of the external web feeds from the threat download section are found in the /SPLUNK-HOME-DIRECTORY/etc/apps/SA-ThreatIntelligence/default/inputs.conf. The exception is HAILATAXII which is in DA-ESS-ThreatIntelligence. Inputs.conf does not have a way to make a feed invisible, just disable the feed.

You could delete those lines from the inputs.conf file and they would not show up in the threat downloads UI, but because it is in the default directory, whenever you preform an upgrade, those default values will be overwritten by the new version of the software and they will reappear. If you are ok with post upgrade pruning of the inputs.conf file, that will give you a way to eliminate those feeds from the list.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...