Splunk is moving from using Stix/Taxii to using the TA TruStar. To get intel feeds, such as H-ISAC, the TruStar TA is the way to go.  https://www.trustar.co/splunk-siem-and-trustar https://splunkbase.splunk.com/app/5542/ I hope this helps! ... View more