Splunk Enterprise Security

ES Search query

So76
Explorer

Hey, has anyone created a search that merges an ipadd from threat intel and ipadd from azure so it'll trigger an alert if there's a match. Don't know if it's possible. Thanks, will appreciate any help or advise. I am new to ES

 

Labels (1)

ro_mc
Path Finder

Good news! The threat intelligence framework does all the hard work for you.

The following link provides an overview of the process, but the main point is that there's a correlation search called "Threat Activity Detected".

https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/threatintelligenceframework/

To configure alerts based on threat intelligence, open Splunk Enterprise Security, click on Content Management, and select a Type of "correlation search". Locate the "Threat Activity Detected" correlation search and enable the search.

By default, the search will run at 10 minutes past each hour and look for threats over the last 65 minutes. Once detected, threat matches will not be reported for another 24 hours.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...