I did manage to get this to work, so I will share my findings with you so you can do the same. There are a few important things you need to take into account. As a test create a csv file like this: description,file_hash,file_name,weight test1,11111hash11111,123.py,5 test2,22222hash22222,123.exe,5 In the Enterprise Security App Go to Configure→Data Enrichment→Threat Intelligence Uploads The most important part of uploading Threat Intel is that you format your csv file properly. One of the greatest pain points encountered when ingesting threat indicators is the naming of fields. The threat intelligence framework expects that specific header field values are being utilized. The reference for this can be found here→ https://docs.splunk.com/Documentation/ES/latest/Admin/Supportedthreatinteltypes Make sure you copy the exact headers and do NOT use whitespaces. Next; I recommend giving the default weight of 5. Make sure you fill in a meaningful Threat Category and Threat Group as these will be the values that populate the dropdowns in the Threat Intelligence dashboards. Save this. Next important thing is to wait a few minutes for the upload to be processed by ES. Go to Security Intelligence->Threat Intelligence->Threat Artifacts and you will see your uploaded values:     ... View more