Dear Splunkers,
Does Splunk enterprise security come with any threat intelligence feed that is solely provided by Splunk?.
Or does Splunk provide any threat intelligence feed?.
Splunk Enterprise Security includes connections to open source threat intelligence feeds, but it is not a threat intelligence collector/provider like an ISAC might be, or like VERIS or Facebook Threat Exchange. It allows you to aggregate threat intelligence, but Splunk the company does not collect any as a service.
Splunk Enterprise Security includes connections to open source threat intelligence feeds, but it is not a threat intelligence collector/provider like an ISAC might be, or like VERIS or Facebook Threat Exchange. It allows you to aggregate threat intelligence, but Splunk the company does not collect any as a service.
Thanks brother for prompt response.
Please do not accept your own answer. Accept Lakshman's answer, so that he gets awarded the karma for correctly answering your question. Thank you!
Yes, Splunk comes with threat intel and also allows you to add your own. Look at step 1 and 2 in https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Addthreatintel
Hi lakshman,
We receive Phishing attack feeds (which we need to manually upload every week) and i am planning to use email_intel as the threat feed. But we have the following header fields Bitcoin address, File names, Terminated Process and Email Subject etc.
For email_intel as per Splunk, we need to use description,src_user,subject,weight.
Is it okay to create this a email_intel or do i have to use a different one?