Splunk Enterprise Security

Splunk Enterprise Security: How to remove threat intelligence feeds from Threat Intelligence Downloads section?

jamesatwork703
Engager

Is there a way to remove threat intelligence feeds from the 'Threat Intelligence Downloads' section? I know I can disable them, but I'd rather get rid of them all together so it's cleaner and easier to read/navigate.

Thanks in advance.

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

The bulk of the external web feeds from the threat download section are found in the /SPLUNK-HOME-DIRECTORY/etc/apps/SA-ThreatIntelligence/default/inputs.conf. The exception is HAILATAXII which is in DA-ESS-ThreatIntelligence. Inputs.conf does not have a way to make a feed invisible, just disable the feed.

You could delete those lines from the inputs.conf file and they would not show up in the threat downloads UI, but because it is in the default directory, whenever you preform an upgrade, those default values will be overwritten by the new version of the software and they will reappear. If you are ok with post upgrade pruning of the inputs.conf file, that will give you a way to eliminate those feeds from the list.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...