Getting Data In

TAXII 2.1 Inputs (Without Splunk Enterprise Security)

himynamesdave
Contributor

Hi all!

I know ES ships with a TAXII client to ingest threat intel over TAXII.

Does anything exist for users who do not have ES?

I am trying to ingest intel (in STIX 2.1) being distributed via a TAXII 2.1 server to Splunk.

Thanks!

Labels (1)
0 Karma

himynamesdave
Contributor

Thanks, yep, understood @PickleRick 

I was wondering if anything existed before building anything. e.g. https://splunkbase.splunk.com/app/2637/ for 2.x versions

I guess I'll take a deeper look at building something new then. Give this post an upvote if you're looking for something similar, and I'll bump it up in terms of my priorities. 

0 Karma

PickleRick
Ultra Champion

You can always pull stix from taxii feed yourself using your favourite scripting/programming language and push results to splunk...

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...