Splunk Enterprise Security

How to "clean up" Splunk Enterprise Security Threat Intelligence lists to remove obsolete entries?

DMohn
Motivator

Hi Splunkers,

We have a running Enterprise Security environment with several Threat Intelligence downloads enabled. To our experience the threat lists downloaded are additive - hence the internal TI lists keep on growing, and obsolete entries are not removed. Now we experienced a case, where a once blacklisted IP range in the Akamai CDN is now used by the customer's CDN, and all traffic to this IP range is deemed malicious and reported in Splunk ESS.

So my questions are:
1) How can we (selectively) clean up the Threat Intelligence lists? Is there a chance to include only the current Threat IPs in the Threat Intelligence store?

2) Is there a way to whitelist IPs (IP ranges) so they won't appear in the Enterprise Security Threat Intelligence Lists?

Any hints are highly appreciated!

Cheers
Dennis

1 Solution

stefanhutchison
Explorer

This is controlled by a setting under the "Threat Intelligence Download Settings" within ES. You can set the "Maximum age" for each threat intelligence feed so that data ages out once it is stale.

Hope this helps!

View solution in original post

stefanhutchison
Explorer

This is controlled by a setting under the "Threat Intelligence Download Settings" within ES. You can set the "Maximum age" for each threat intelligence feed so that data ages out once it is stale.

Hope this helps!

kausar
Path Finder

If nothing is set, does this mean that it is unlimited or is there any default max age?

0 Karma

aqtran82
New Member

Apparently that feature for setting the Maximum Age is available on newer versions of ES. Is there another way to do this for older versions ? 3.3.x ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...