Splunk Enterprise Security: Why are there empty ES Lookups?

[Abbasali_82]

Hi,

We use Splunk Enterprise Security (ES) and in our DATA Enrichment --> List and look Ups, we have the below lists which are completely blank:

Local Certificate Intel
Local Domain Intel
Local Email Intel
Local File Intel
Local HTTP Intel
Local IP Intel

What i see in the ES dashboard is that legitimate websites (e.g. outlook.live.com) are being flagged under the malicious domains group.

I see ip_intel and file_intel as the most active threat collections. I think these are being flagged incorrectly since these feeds/lists are blank.

Should this go away if i were to disable these lists?
Also is there a recommended source from where i could populate and regularly update these lists.

Help in the right direction would me much appreciated.

Abbas

[jstoner_splunk]

The local intel lookups are a place where you can place threat intel specific to your organization. The threat downloads coming in from external sites do not hit those lists and lookups but are extracted to threat collections which are seen in the threat artifacts dashboard. I can't speak to the presence of outlook.live.com. You can see the raw files in the SA-ThreatIntelligence subdirectory of what is coming in through the Threat Downloads section.

[season88481]

So if I add some IP address on the local_ip_intel lookup file, will they appear on the "threat activity" panel?

[AbubakarShahid]

I am also wondering the same thing. I know if it in KV (ip_intel or http_intel) then you will see it. but was wondering if its in local is there a back end search at automatically adds it to KV. Let me know if you were ale to figure it out. Would love to hear some feed back.