Splunk Enterprise Security

Threat_Intelligence.Threat_Activity- How can I configure these fields "orig_sourcetype" ?

Cayplos
Engager

Hi,

I use Splunk Enterprise Security with Threat Intelligence framework.

Splunk creates many notables 'Threat Activity Detected' but I'd like to add/remove/edit source types.

I have only events with field "orig_sourcetype="apache:access" now. For example I tried add events from firewalls and compare source with suspicious IPs.

How can I configure these fields "orig_sourcetype" in Threat Intelligence data model ?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Cayplos,

it isn't an immediate activity:

you have to understand which Data Model is used by the Correlation Search,

then you have to see the tags that are used to populate this Data Model,

then you have to see how your additional logs are parsed, are you using a CIM4.x compliant Add-On,?probably not because they are, by default, normalized and tagged in the correct way to load events in the Data Model.

If you're using a custom Add-On you have to normalize it using e.g. the App Builder App.

Ciao.

Giuseppe

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...