Splunk® Enterprise Security

Administer Splunk Enterprise Security

Download manual as PDF

This documentation does not apply to the most recent version of ES. Click here for the latest version.
Download topic as PDF

Configure the threat intelligence sources included with Splunk Enterprise Security

Splunk Enterprise Security includes several threat intelligence sources that retrieve information across the Internet.

Some of these threat intelligence sources are enabled by default.

Prerequisites

  • Your Splunk Enterprise deployment must be connected to the Internet. If your deployment is not connected to the Internet, disable these threat sources or source them in an alternate way.
  • To set up firewall rules for these threat sources, you might want to use a proxy server to collect the threat intelligence before forwarding it to Splunk Enterprise Security and allow the IP address for the proxy server to access Splunk Enterprise Security. The IP addresses for these threat sources can change.

Steps

  1. From the Enterprise Security menu bar, select Configure > Data Enrichment > Threat Intelligence Downloads.
  2. Review the Description field for all defined threat intelligence sources to learn more about the types of indicators that can be correlated with your events.
  3. Enable or disable the threat intelligence sources that fit your security use cases.
  4. Configure the enabled threat intelligence sources that fit your security use cases, using the links to the threat source websites in the table to review the threat source provider's documentation. Each threat source website provides suggestions for polling intervals and other configuration requirements separate from Splunk Enterprise Security.
Threat source Threat list provider Website about the threat source
Emerging Threats compromised IPs blocklist Emerging Threats http://rules.emergingthreats.net/blockrules
Emerging Threats firewall IP rules Emerging Threats http://rules.emergingthreats.net/fwrules
Malware domain host list Hail a TAXII.com http://hailataxii.com
iblocklist Logmein I-Blocklist https://www.iblocklist.com/lists
iblocklist Piratebay I-Blocklist https://www.iblocklist.com/lists
iblocklist Proxy I-Blocklist https://www.iblocklist.com/lists
iblocklist Rapidshare I-Blocklist https://www.iblocklist.com/lists
iblocklist Spyware I-Blocklist https://www.iblocklist.com/lists
iblocklist Tor I-Blocklist https://www.iblocklist.com/lists
iblocklist Web attacker I-Blocklist https://www.iblocklist.com/lists
Malware Domain Blocklist Malware Domains http://mirror1.malwaredomains.com
Phishtank Database Phishtank https://www.phishtank.com/
SANS blocklist SANS https://isc.sans.edu
abuse.ch ZeuS blocklist (bad IPs only) abuse.ch https://zeustracker.abuse.ch
abuse.ch ZeuS blocklist (standard) abuse.ch https://zeustracker.abuse.ch

Splunk Enterprise Security expects all threat intelligence feeds to send properly-formatted data and valuable threat intelligence information. Feed providers are responsible for malformed data or false positives that could be identified in your environment as a result.

Some lists included in Splunk Enterprise Security are not added to the threat intelligence collections and are instead used to enrich data in Enterprise Security.

Data list Data provider Website for data provider
Alexa Top 1 Million Sites Alexa Internet http://www.alexa.com/topsites
Mozilla Public Suffix List Mozilla https://publicsuffix.org
ICANN Top-level Domains List IANA http://www.iana.org/domains/root/db

If you determine that your Splunk Enterprise Security installation is retrieving data from unexpected IP addresses, perform a WHOIS or nslookup to determine if the IP address matches that of one of the threat sources configured in your environment.

Next step

To add a custom threat source, see Add threat intelligence to Splunk Enterprise Security and follow the link that matches the source that you want to add.

If you are finished adding threat intelligence sources, see Verify that you have added threat intelligence successfully in Splunk Enterprise Security.

PREVIOUS
Supported types of threat intelligence in Splunk Enterprise Security
  NEXT
Download a threat intelligence feed from the Internet in Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5, 4.7.6


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters