Example: Add a generic intelligence source to Splunk Enterprise Security
As a security analyst, you want to compare hosts seen in your network with the hosts associated with Spotify advertisements so that you can assess the risk that listening to Spotify Free during the work day poses to your network. The hosts associated with Spotify ads are not malicious, and you do not want to add them to Splunk Enterprise Security as threat intelligence. Instead, you can add them as generic intelligence.
Download the generic intelligence
First, create a download configuration for the list.
- Select Configure > Data Enrichment > Threat Intelligence Management.
- Click New > Line Oriented.
- On the General tab, type a Name of
spotify_ads. - Deselect the check box for Is Threat Intelligence.
- Type a Type of
spotify_ads. - Type a Description of Hostnames of machines hosting Spotify ads.
- Type a URL of
https://raw.githubusercontent.com/FadeMind/hosts.extras/primary/StreamingAds/hosts. - (Optional) Change the default Weight.
- (Optional) Change the default Interval.
- In the Parsing tab, type a delimiting regular expression of
\s. - Type Fields of
url:$2. - Type an Ignoring regular expression of
(^#|^\s*$). - Click Save.
Verify that the intelligence downloads successfully
Using search, verify that the modular input is downloading information from the source.
| inputintelligence no_parse=1 spotify_ads
Verify that the intelligence parses correctly
Use the custom search command inputintelligence to verify that the intelligence parses correctly.
| inputintelligence spotify_ads
If the intelligence does not seem to be parsing correctly, review search.log for any error messages. In addition, you can change the parsing settings for the download using the optional arguments for the inputintelligence command to determine the correct settings. See Use generic intelligence in search with inputintelligence.
Use the new intelligence source in a search
You can use the new intelligence source in many ways in searches.
Use Spotify ads in a subsearch
To return 100 URLs used by Spotify ads in a list with the following subsearch:
| search [| inputintelligence spotify_ads | return 100 url]
Use Spotify ads in join
Join the hosts in the Spotify ads intelligence source with another set of data with join:
... | join url [| inputintelligence spotify_ads | eval spotify_ad="true"] | search spotify_ad="true"
Add Spotify ads to a lookup table file
Add the hosts from Spotify ads to a lookup table file using a lookup generating search:
| inputintelligence spotify_ads | eval spotify_ad="true" | outputlookup spotify_ads.csv
After creating the lookup, use it in search with the following example search:
... | lookup spotify_ads.csv url OUTPUT spotify_ad | search spotify_ad="true"
| Use generic intelligence in search with inputintelligence | Managing content in Splunk Enterprise Security |
This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1, 7.0.2, 7.1.0, 7.1.1, 7.1.2, 7.2.0, 7.3.0, 7.3.1, 7.3.2
Download manual
Feedback submitted, thanks!