Splunk Enterprise Security

Threat Intelligence Management - Wrong threat match field?



I have looked at Threat match "src" under Threat Intelligence Manager.

In the configuration the datamodel DNS Resolution is enabled and the match field is DNS.query.

However, in the generated SPL i find these to lines:


| eval "threat_match_field"=if(isnull('threat_match_field'),"src",'threat_match_field') 
| eval "threat_match_value"=if(isnull('threat_match_value'),'DNS.query','threat_match_value')


This will change the threat_match_field to src, but I would have thought it should be "query"?

And this will make a wrong description in the Threat Activity use case when the fields are populated.

Is this a fault, have anyone else noticed this?

Get Updates on the Splunk Community!

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...