Splunk Enterprise Security: How to remove threat intelligence feeds from Threat Intelligence Downloads section?

[jamesatwork703]

Is there a way to remove threat intelligence feeds from the 'Threat Intelligence Downloads' section? I know I can disable them, but I'd rather get rid of them all together so it's cleaner and easier to read/navigate.

Thanks in advance.

[jstoner_splunk]

The bulk of the external web feeds from the threat download section are found in the /SPLUNK-HOME-DIRECTORY/etc/apps/SA-ThreatIntelligence/default/inputs.conf. The exception is HAILATAXII which is in DA-ESS-ThreatIntelligence. Inputs.conf does not have a way to make a feed invisible, just disable the feed.

You could delete those lines from the inputs.conf file and they would not show up in the threat downloads UI, but because it is in the default directory, whenever you preform an upgrade, those default values will be overwritten by the new version of the software and they will reappear. If you are ok with post upgrade pruning of the inputs.conf file, that will give you a way to eliminate those feeds from the list.