About oz_dg

oz_dg · ‎12-03-2020

Hoping that there is way forward with this one. Many thanks in advance.

oz_dg · ‎11-23-2020

Hi, Many thanks for the reply. We've been using those already but were kinda hoping we could move away from them (2yrs+ since last update on the github page + no SplunkApp Inspection pass mark) and use the general taxii feed input as it works fine for other feeds. Cheers

oz_dg · ‎11-22-2020

Hi everyone, Am having issues with the configuration of the AlienVault OTX feed in Splunk ES and would appreciate any help. Have got my AlienVault OTX key ready but need help with the Threat Intel taxii feed settings in the web gui. Data inputs » Intelligence Downloads » Type: taxii URL: https://otx.alienvault.com/taxii/discovery POST Arguments: <this is where my key should be placed but how is this formatted??> -> have tried taxii_username="my_key" in the post arguments to no avail. Just keep seeing the "TAXII feed polling starting" message on the "Threat Intelligence Audit" page. Any help is greatly appreciated. Cheers

Posts	3
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎11-22-2020

Online Status	Offline
Date Last Visited	‎12-07-2020 03:00 AM

Splunk ES taxii feed - AlienVault OTX config

Re: Splunk ES taxii feed - AlienVault OTX config

Re: Splunk ES taxii feed - AlienVault OTX config

Splunk ES taxii feed - AlienVault OTX config