Splunk Enterprise Security

is it possible to create a new threat intelligence source with json format in Enterprise Security ?

asimagu
Builder

Hey gents

My customer is asking me to create a new threat intelligence source in the Enterprise Security app (version 4.5.1.)
He told me that he is going to provide an .ioc file with the fields and values in json format.....

This is my first time doing this and I am not quite sure it can be done as I have read everywhere that ioc files come in xml format, not json....

could you guys confirm this?? any word of advise I could use?

thanks a lot

1 Solution

lguinn2
Legend

Yes, this can be done. Any new input can be integrated as an intelligence source - if it is normalized according to the Common Information Model (CIM) and integrated properly. The CIM is packaged with Enterprise Security, but it has its own manual. You should also look at the Enterprise Security manual. Install and deploy add-ons is an important section, especially the sub-topic on importing custom add-ons. You should also read the section on Data source planning.

Be sure to carefully test that your new source appears in the ES data models and correlation searches.

View solution in original post

0 Karma

lguinn2
Legend

Yes, this can be done. Any new input can be integrated as an intelligence source - if it is normalized according to the Common Information Model (CIM) and integrated properly. The CIM is packaged with Enterprise Security, but it has its own manual. You should also look at the Enterprise Security manual. Install and deploy add-ons is an important section, especially the sub-topic on importing custom add-ons. You should also read the section on Data source planning.

Be sure to carefully test that your new source appears in the ES data models and correlation searches.

0 Karma

asimagu
Builder

Hi Lisa, thanks for your help.

I understand currently there is no json parser built into the Threat Intelligence Framework in Splunk ES and that I would need to create a custom TA to fetch the data from a url and then normalize the fields according to the CIM. Then the data would get indexed in Splunk and I would need to create some saved searches to create a KVStore lookup or CSV lookup that the Threat Intelligence Framework already monitors.

did I get it right??

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...