Splunk Enterprise Security: Do I need to create a new correlation search to use threat intelligence?

[irsysintegratio]

Hello,

We are researching on integration with Splunk Enterprise Security (ES), and I have a question about threat intelligence.

I added a CSV file for threat intelligence download, and I can see that the ip address stored in the CSV file has been extracted successfully and added to the threat intelligent artifacts. My question is how to use this newly added IOC? Do I need to create a new correlation research to use it? Or will it be used automatically by Splunk ES built-in correlation search?

Thanks!

[jstoner_splunk]

By default there is a correlation search that is pre-built into the system called Threat Activity Detected that can be turned on and run by default. You can modify it or create additional correlation searches if you would like.

[irsysintegratio]

The result of this pre-built correlation research is shown in the "Threat Activity Detected" dashboard? Somehow it does not work.
1. We added a simple CSV file with an IP address 10.122.25.51.
2. We verified that this IP address appears in the ip_intel. This means Splunk ES parsed the CSV file and extracted the IOC properly, right?
3. We verified that there are simulated active events with dest="10.122.25.51". But there is not notable event created. Threat Activity Detected dashboard does not show notable event caused by this IP address being detected.

Anything missing here? How can we debug this please?

Thanks!

[jstoner_splunk]

The default correlation would show in threat activity dashboard as well as would generate a notable event provided the correlation search is enabled and configured. There is a bit of housekeeping that is performed to prepare the data. I would take a look at the threat gen saved searches within ES, specifically Threat - Source And Destination Matches - Threat Gen and take a look at the search interval and also the search to ensure it runs. You can also look at the threat activity data model data and see what is in there as this is where the correlation search looks.