Splunk Enterprise Security

Splunk Enterprise Security: Why are there empty ES Lookups?

Abbasali_82
New Member

Hi,

We use Splunk Enterprise Security (ES) and in our DATA Enrichment --> List and look Ups, we have the below lists which are completely blank:

Local Certificate Intel
Local Domain Intel
Local Email Intel
Local File Intel
Local HTTP Intel
Local IP Intel

What i see in the ES dashboard is that legitimate websites (e.g. outlook.live.com) are being flagged under the malicious domains group.

I see ip_intel and file_intel as the most active threat collections. I think these are being flagged incorrectly since these feeds/lists are blank.

Should this go away if i were to disable these lists?
Also is there a recommended source from where i could populate and regularly update these lists.

Help in the right direction would me much appreciated.

Abbas

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

The local intel lookups are a place where you can place threat intel specific to your organization. The threat downloads coming in from external sites do not hit those lists and lookups but are extracted to threat collections which are seen in the threat artifacts dashboard. I can't speak to the presence of outlook.live.com. You can see the raw files in the SA-ThreatIntelligence subdirectory of what is coming in through the Threat Downloads section.

0 Karma

season88481
Contributor

So if I add some IP address on the local_ip_intel lookup file, will they appear on the "threat activity" panel?

0 Karma

AbubakarShahid
New Member

I am also wondering the same thing. I know if it in KV (ip_intel or http_intel) then you will see it. but was wondering if its in local is there a back end search at automatically adds it to KV. Let me know if you were ale to figure it out. Would love to hear some feed back.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...