Splunk Search

How do I manually import threat intelligence downloads for internal deployments (no internet)?

thomasaporter
Explorer

Is there anyway to manually import threat intelligence downloads for internal servers (offline from the internet)? Yes, I know that since the system is not connected to the internet, I should not have to worry about external threats. However, we do manually import event data that has come from the outside for our investigations, and I would like to correlate those against threat lists.

0 Karma
1 Solution

sjohnson_splunk
Splunk Employee
Splunk Employee

For OpenIOC and STIX files there is a location on the SH where you can put the files and they will automagically be loaded.

For other sources you can build a lookup file and then add it as a new source via the Web UI.

See this link for the details:

http://docs.splunk.com/Documentation/ES/4.2.0/User/Configureblocklists

View solution in original post

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

For OpenIOC and STIX files there is a location on the SH where you can put the files and they will automagically be loaded.

For other sources you can build a lookup file and then add it as a new source via the Web UI.

See this link for the details:

http://docs.splunk.com/Documentation/ES/4.2.0/User/Configureblocklists

0 Karma

thomasaporter
Explorer

Cool....many thanks for the quick reply.

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Are you using Splunk Enterprise Security? If so, what version?

0 Karma

thomasaporter
Explorer

Splunk Enterprise 6.4.2 with Splunk App for Enterprise Security 4.1.1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...