is it possible to create a new threat intelligence source with json format in Enterprise Security ?

[asimagu]

Hey gents

My customer is asking me to create a new threat intelligence source in the Enterprise Security app (version 4.5.1.)
He told me that he is going to provide an .ioc file with the fields and values in json format.....

This is my first time doing this and I am not quite sure it can be done as I have read everywhere that ioc files come in xml format, not json....

could you guys confirm this?? any word of advise I could use?

thanks a lot

[lguinn2 · Accepted solution]

Yes, this can be done. Any new input can be integrated as an intelligence source - if it is normalized according to the Common Information Model (CIM) and integrated properly. The CIM is packaged with Enterprise Security, but it has its own manual. You should also look at the Enterprise Security manual. Install and deploy add-ons is an important section, especially the sub-topic on importing custom add-ons. You should also read the section on Data source planning.

Be sure to carefully test that your new source appears in the ES data models and correlation searches.

[asimagu]

Hi Lisa, thanks for your help.

I understand currently there is no json parser built into the Threat Intelligence Framework in Splunk ES and that I would need to create a custom TA to fetch the data from a url and then normalize the fields according to the CIM. Then the data would get indexed in Splunk and I would need to create some saved searches to create a KVStore lookup or CSV lookup that the Threat Intelligence Framework already monitors.

did I get it right??