Splunk Enterprise Security

is it possible to create a new threat intelligence source with json format in Enterprise Security ?

asimagu
Builder

Hey gents

My customer is asking me to create a new threat intelligence source in the Enterprise Security app (version 4.5.1.)
He told me that he is going to provide an .ioc file with the fields and values in json format.....

This is my first time doing this and I am not quite sure it can be done as I have read everywhere that ioc files come in xml format, not json....

could you guys confirm this?? any word of advise I could use?

thanks a lot

1 Solution

lguinn2
Legend

Yes, this can be done. Any new input can be integrated as an intelligence source - if it is normalized according to the Common Information Model (CIM) and integrated properly. The CIM is packaged with Enterprise Security, but it has its own manual. You should also look at the Enterprise Security manual. Install and deploy add-ons is an important section, especially the sub-topic on importing custom add-ons. You should also read the section on Data source planning.

Be sure to carefully test that your new source appears in the ES data models and correlation searches.

View solution in original post

0 Karma

lguinn2
Legend

Yes, this can be done. Any new input can be integrated as an intelligence source - if it is normalized according to the Common Information Model (CIM) and integrated properly. The CIM is packaged with Enterprise Security, but it has its own manual. You should also look at the Enterprise Security manual. Install and deploy add-ons is an important section, especially the sub-topic on importing custom add-ons. You should also read the section on Data source planning.

Be sure to carefully test that your new source appears in the ES data models and correlation searches.

0 Karma

asimagu
Builder

Hi Lisa, thanks for your help.

I understand currently there is no json parser built into the Threat Intelligence Framework in Splunk ES and that I would need to create a custom TA to fetch the data from a url and then normalize the fields according to the CIM. Then the data would get indexed in Splunk and I would need to create some saved searches to create a KVStore lookup or CSV lookup that the Threat Intelligence Framework already monitors.

did I get it right??

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...