Getting Data In

TAXII 2.1 Inputs (Without Splunk Enterprise Security)

himynamesdave
Contributor

Hi all!

I know ES ships with a TAXII client to ingest threat intel over TAXII.

Does anything exist for users who do not have ES?

I am trying to ingest intel (in STIX 2.1) being distributed via a TAXII 2.1 server to Splunk.

Thanks!

Labels (1)
0 Karma

himynamesdave
Contributor

Thanks, yep, understood @PickleRick 

I was wondering if anything existed before building anything. e.g. https://splunkbase.splunk.com/app/2637/ for 2.x versions

I guess I'll take a deeper look at building something new then. Give this post an upvote if you're looking for something similar, and I'll bump it up in terms of my priorities. 

0 Karma

PickleRick
Ultra Champion

You can always pull stix from taxii feed yourself using your favourite scripting/programming language and push results to splunk...

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...