Splunk Enterprise Security

Splunk Enterprise Security: How to remove threat intelligence feeds from Threat Intelligence Downloads section?

jamesatwork703
Engager

Is there a way to remove threat intelligence feeds from the 'Threat Intelligence Downloads' section? I know I can disable them, but I'd rather get rid of them all together so it's cleaner and easier to read/navigate.

Thanks in advance.

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

The bulk of the external web feeds from the threat download section are found in the /SPLUNK-HOME-DIRECTORY/etc/apps/SA-ThreatIntelligence/default/inputs.conf. The exception is HAILATAXII which is in DA-ESS-ThreatIntelligence. Inputs.conf does not have a way to make a feed invisible, just disable the feed.

You could delete those lines from the inputs.conf file and they would not show up in the threat downloads UI, but because it is in the default directory, whenever you preform an upgrade, those default values will be overwritten by the new version of the software and they will reappear. If you are ok with post upgrade pruning of the inputs.conf file, that will give you a way to eliminate those feeds from the list.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...