Splunk Enterprise Security

How to parse API key to access URL (list) provided by threat intelligence service?

siddh01r
New Member

Hi there,

We now have a service that provides us with a threat intel list. However, if we need to access that URL, we need to parse an API key.

Can someone suggest how I could get this sorted?

Has someone previously done this?

Thanks.

Labels (1)
0 Karma

PavelP
Motivator

Hello @siddh01r

first check on Splunkbase if there is an app/add-on for it: https://splunkbase.splunk.com/

Alternatevely, you can access external url using this app: https://splunkbase.splunk.com/app/4146/ written by @jkat54

siddh01r
New Member

Hi There,

Thanks for the recommendation. However, how will i use this app to connect back to my threat intel feed?

what it should do:
1. Use API to connect to external url to retrieve the threat intel feed.
2. intel feed gets downloaded in Splunk Enterprise Security

Thanks in advance.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!