We now have a service that provides us with a threat intel list. However, if we need to access that URL, we need to parse an API key.
Can someone suggest how I could get this sorted?
Has someone previously done this?
first check on Splunkbase if there is an app/add-on for it: https://splunkbase.splunk.com/
Alternatevely, you can access external url using this app: https://splunkbase.splunk.com/app/4146/ written by @jkat54
Thanks for the recommendation. However, how will i use this app to connect back to my threat intel feed?
what it should do:
1. Use API to connect to external url to retrieve the threat intel feed.
2. intel feed gets downloaded in Splunk Enterprise Security
Thanks in advance.