Splunk Enterprise Security

Threat Intel module mapping multiple fields to same variable

avivn
Explorer

Hi,

In threat intel module when adding a new threat feed source,

The feed contains also sha-256 and MD5 but I can map only one of them to the file_hash var,

There is an option to map multiple fields into the same var?

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @avivn,

You can add the same threat intel source twice by selecting different field as var.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...