This works! Thanks. ... View more

See this https://answers.splunk.com/answers/223408/what-are-the-minimum-splunk-capabilities-i-need-to.html ... View more

Hi clarkwh2 -- The conf file used to store TAXII feed configurations is ../local/inputs.conf. An example entry would look like: [threatlist://<input_name>] description = TAXII description disabled = false interval = 86400 post_args = collection="<taxii_collection>" earliest="-1y" taxii_username="user" taxii_password="pass" type = taxii url = <url to taxii discovery service> Docs pertaining to the available options for this modular input can be found in SA-ThreatIntelligence, under README/inputs.conf.spec Hope this helps, ~Brian ... View more