Splunk Search

How to create a correlation search based on data provided by SANS Threat Intelligence?

Kitag345
Explorer

 

Hello,

I would like to request guidance on how to create a correlation search based on data provided by SANS Threat Intelligence from https://isc.sans.edu/block.txt

The malicious IPs from "block.txt" are updated regularly. How can my correlation search track that change in real-time? What queries to use?

Notes: The SANS Threat Intel has already been enabled. 

 

 

Tags (1)
0 Karma
1 Solution

nyc_jason
Splunk Employee
Splunk Employee

consider using the PAVO Getwatchlist add-on, then you can do this:

nyc_jason_0-1676655724605.png

Or for performance, schedule the search every 30min, and pipe it to a lookup. then run your search using the lookup for matches.

View solution in original post

nyc_jason
Splunk Employee
Splunk Employee

consider using the PAVO Getwatchlist add-on, then you can do this:

nyc_jason_0-1676655724605.png

Or for performance, schedule the search every 30min, and pipe it to a lookup. then run your search using the lookup for matches.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...