stix Threat Intelligence Upload

[tmwhitm]

Splunkers,

Once a stix formatted IOC file has been successfully uploaded via Splunk Enterprise Security "Upload Threat Intelligence", I'd like to view the contents of that upload to review the IOCs but I have not been able to see that information, let alone the file listed anywhere. There is an SA-SPLICE application in Splunkbase but that has not been updated since 2015 and doesn't support the latest file formats.

1. Where in Splunk ES can I view the contents of the uploaded IOC?
2. How can I confirm the IOC is enabled and providing intel to Splunk ES?

Thank you,

Tom

[jaime_ramirez]

Have you tried this?

https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Verifythreatintel

So in Security Intelligence > Threat Intelligence > Threat Artifacts, you should be able to find your Threat Source with its Intel Source ID.

Later I could elaborate more on the subject.

Hope it helps!!!