Splunk Enterprise Security

ES Threat Intel unable to capture hash values from csv upload

att35
Builder

Hi,

I am trying to upload a custom CSV for Threat Intel within ES. It's a collection of multiples types of IOC's, (domain, url, hash etc) and is in the following column format.

CSV_Headers.png

There are 343 Hash values, 20 domains and 8 URL's. Upload goes without any issues and ES collects domains and URL's right away. But Hash values seem to be ignored. Here are the file details under Threat Artifacts.

csv_artifact.png

When I check Threat Intel Audit, it seems to be writing to File Intel as well but hash count never gets populated in ES.

csv_audit.png

What could be going wrong here?

Splunk version: 8.1.1

ES Version: 6.4.0

Thanks,

~ Abhi

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...