Splunk buildin intelligence feed

[hariskhan]

Dear Splunkers,

Does Splunk enterprise security come with any threat intelligence feed that is solely provided by Splunk?.

Or does Splunk provide any threat intelligence feed?.

[smoir_splunk · Accepted solution]

Splunk Enterprise Security includes connections to open source threat intelligence feeds, but it is not a threat intelligence collector/provider like an ISAC might be, or like VERIS or Facebook Threat Exchange. It allows you to aggregate threat intelligence, but Splunk the company does not collect any as a service.

[hariskhan]

Thanks brother for prompt response.

[smoir_splunk]

Please do not accept your own answer. Accept Lakshman's answer, so that he gets awarded the karma for correctly answering your question. Thank you!

[lakshman239]

Yes, Splunk comes with threat intel and also allows you to add your own. Look at step 1 and 2 in https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Addthreatintel

[spectrum2035]

Hi lakshman,

We receive Phishing attack feeds (which we need to manually upload every week) and i am planning to use email_intel as the threat feed. But we have the following header fields Bitcoin address, File names, Terminated Process and Email Subject etc.

For email_intel as per Splunk, we need to use description,src_user,subject,weight.

Is it okay to create this a email_intel or do i have to use a different one?