Hi @mackey If you have ES, it has a framework called "THREAT INTELLIGENCE" for managing threat feeds, detecting threats, and sending alerts. You should explore this functionality, as it can be quite beneficial. Additionally, there are several other high-quality sources of threat data available in that which just need to be activated if required OR if you have your own custom feeds, you can also integrate them as custom lookups in threat intelligence. As mentioned by @gcusello you have two options , explore it as per your requirement. For more info on this , please refer the below docs: https://lantern.splunk.com/Security/UCE/Guided_Insights/Threat_intelligence/Using_threat_intelligence_in_Splunk_Enterprise_Security https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/threatintelligenceframework/ https://www.splunk.com/en_us/pdfs/feature-brief/splunk-threat-intelligence-management.pdf If this helps, accept the answer by upvoting !! Happy Splunking !!
... View more