Splunk Enterprise Security

Splunk Enterprise Security: How to remove threat intelligence feeds from Threat Intelligence Downloads section?

jamesatwork703
Engager

Is there a way to remove threat intelligence feeds from the 'Threat Intelligence Downloads' section? I know I can disable them, but I'd rather get rid of them all together so it's cleaner and easier to read/navigate.

Thanks in advance.

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

The bulk of the external web feeds from the threat download section are found in the /SPLUNK-HOME-DIRECTORY/etc/apps/SA-ThreatIntelligence/default/inputs.conf. The exception is HAILATAXII which is in DA-ESS-ThreatIntelligence. Inputs.conf does not have a way to make a feed invisible, just disable the feed.

You could delete those lines from the inputs.conf file and they would not show up in the threat downloads UI, but because it is in the default directory, whenever you preform an upgrade, those default values will be overwritten by the new version of the software and they will reappear. If you are ok with post upgrade pruning of the inputs.conf file, that will give you a way to eliminate those feeds from the list.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!