Threat_Intelligence.Threat_Activity- How can I configure these fields "orig_sourcetype" ?

[Cayplos]

Hi,

I use Splunk Enterprise Security with Threat Intelligence framework.

Splunk creates many notables 'Threat Activity Detected' but I'd like to add/remove/edit source types.

I have only events with field "orig_sourcetype="apache:access" now. For example I tried add events from firewalls and compare source with suspicious IPs.

How can I configure these fields "orig_sourcetype" in Threat Intelligence data model ?

[gcusello]

Hi @Cayplos,

it isn't an immediate activity:

you have to understand which Data Model is used by the Correlation Search,

then you have to see the tags that are used to populate this Data Model,

then you have to see how your additional logs are parsed, are you using a CIM4.x compliant Add-On,?probably not because they are, by default, normalized and tagged in the correct way to load events in the Data Model.

If you're using a custom Add-On you have to normalize it using e.g. the App Builder App.

Ciao.

Giuseppe