Splunk Enterprise Security

Splunk buildin intelligence feed

hariskhan
Explorer

Dear Splunkers,

Does Splunk enterprise security come with any threat intelligence feed that is solely provided by Splunk?.

Or does Splunk provide any threat intelligence feed?.

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

Splunk Enterprise Security includes connections to open source threat intelligence feeds, but it is not a threat intelligence collector/provider like an ISAC might be, or like VERIS or Facebook Threat Exchange. It allows you to aggregate threat intelligence, but Splunk the company does not collect any as a service.

View solution in original post

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Splunk Enterprise Security includes connections to open source threat intelligence feeds, but it is not a threat intelligence collector/provider like an ISAC might be, or like VERIS or Facebook Threat Exchange. It allows you to aggregate threat intelligence, but Splunk the company does not collect any as a service.

0 Karma

hariskhan
Explorer

Thanks brother for prompt response.

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Please do not accept your own answer. Accept Lakshman's answer, so that he gets awarded the karma for correctly answering your question. Thank you!

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Yes, Splunk comes with threat intel and also allows you to add your own. Look at step 1 and 2 in https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Addthreatintel

spectrum2035
Explorer

Hi lakshman,

We receive Phishing attack feeds (which we need to manually upload every week) and i am planning to use email_intel as the threat feed. But we have the following header fields Bitcoin address, File names, Terminated Process and Email Subject etc.

For email_intel as per Splunk, we need to use description,src_user,subject,weight.

Is it okay to create this a email_intel or do i have to use a different one?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...