This documentation topic on threat intelligence applies only to users with access to the threat intelligence management (cloud) system, and not the threat intelligence management system, in Splunk Enterprise Security

Available premium intelligence sources for Splunk Enterprise Security

Premium intelligence sources are closed sources that are available only if you have a commercial relationship, such as a paid license or subscription, to a third-party source. Premium intelligence sources also include open with membership sources, or groups that you hold membership in such as an ISAC or ISAO.

Use the following table to find the information required to subscribe to a premium intelligence source:

Intelligence source	Description	Update type	Update frequency	Supported observable types	Requirements
AbuseIPDB	Provides a deny list for IP addresses that have been associated with malicious activity.	Query-based	15 minutes	IP4	A trial or paid subscription with API key
AlienVault OTX Pulse	Provides access to community-generated threat data.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	Alienware OTX subscription Alienware OTX API key
A-ISAC	Facilitates the sharing of timely, actionable information related to threats, vulnerabilities, incidents, potential protective measures, and best practices.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	A-ISAC subscription A-ISAC username A-ISAC password
Bambenek C2 DGA	Provides a feed of command and control indicators and monitors malicious networks.	Feed-based	60 minutes	DOMAIN	Bambenek DGA Feed subscription Bambenek DGA Feed API key
Bambenek C2 Domain	Provides a feed of command and control domain names and monitors malicious networks.	Feed-based	60 minutes	DOMAIN	Bambenek C2 Domain subscription Bambenek Domain IP Feed API key Bambenek Domain IP Feed API secret
Bambenek C2 IP	Provides a feed of command and control IP addresses and monitors malicious networks.	Feed-based	60 minutes	IP	Bambenek C2 IP Feed subscription Bambenek C2 IP Feed API key Bambenek C2 IP Feed API secret
Cisco Secure Malware Analytics Indicators Feed	Provides content feeds of curated sets of indicators.	Feed-based	10 minutes	IP DOMAIN URL SHA256 SHA1 MD5 URL REGISTRY_KEY	Cisco Secure Malware Analytics license API key
Cisco Secure Malware Analytics Analysis Feed	Provides content feeds of curated sets of indicators.	Feed-based	10 minutes	IP DOMAIN URL SHA256 SHA1 MD5 URL REGISTRY_KEY	Cisco Secure Malware Analytics license API key
Cofense Intelligence	Provides accurate alerts about cryptojacking malware and other possible attacks circulating in phishing emails.	Feed-based	15 minutes	EMAIL_ADDRESS HASH IP URL SOFTWARE	Cofense Intelligence subscription API key API secret
Crowdstrike Falcon Intelligence	Provides a list of detection IDs based on parameters.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	Crowdstrike license Access to Crowdstrike Falcon Intelligence API ID and API key for the reports API Client custom region assigned to your license by Crowdstrike
Cyjax	Provides threat intelligence covering cyber, physical, and political focuses.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL EMAIL_ADDRESS	A paid subscription to Cyjax Cyjax API key
Digital Shadows	Provides threat intelligence by combining scalable data analytics with human data analysts to manage and mitigate risks.	Feed-based	10 minutes	IP URL MD5 SHA1	Digital Shadows license API key
Dragos	Provides actionable insights, analyses, alerts, and reports illuminating malicious activity and relevant recommendations.	Feed-based	360 minutes	MD5 SHA1 SHA256 IP address URL Software	Dragos subscription API key API secret
Flashpoint Indicator Feed	Provides intelligence reports, technical data, and uniquely sourced conversations from illicit threat actor communities.	Feed-based	15 minutes	The Flashpoint REST API is a MISP REST API, so all supported observables reflect thse of MISP. To see a list of supported observables for Flashpoint, see the supported observables for MISP in this table.	Flashpoint subscription API key
Flashpoint Reports Feed	Provides access to illicit communities including closed, invite-only, and password-protected sources, as well as paste sites, technical data, stolen credentials, and social media sites exploited by threat actors.	Feed-based	15 minutes	The Flashpoint REST API is a MISP REST API, so all supported observables reflect those of MISP. To see a list of supported observables for Flashpoint, see the supported observables for MISP in this table.	Flashpoint subscription API key
FS-ISAC	Provides critical cyber-intelligence and builds awareness through alerts, indicators, member insights, threat assessments and analysis.	Feed-based	360 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	FS-ISAC membership API username API password
Intel 471 Adversary Intelligence	Provides timely data and context on malware and adversary infrastructure.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS	Intel 471 subscription API ID API key
Intel 471 Alerts	Provides an actor-centric intelligence collection capability.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS	Intel 471 subscription API ID API key
Intel 471 Malware Intelligence	Provides a high fidelity and timely indicator feed with rich context, TTP information, and malware intelligence reports.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS	Intel 471 subscription API ID API key
Joe Sandbox Feeds	Provides analysis reports on malware targeting.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	Joe Security registration Joe Sandbox Cloud API key
Mandiant Indicators Feed	Provides threat intelligence to reduce threats from fast-changing actors, detect emerging attacks, and reduce existing organizational threat risk surface.	Feed-based	10 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	iSight intelligence subscription iSight public key (API ID) iSight private key (API secret)
MISP	Gathers, shares, stores and correlates IOCs from targeted attacks, threat intelligence, financial fraud information, vulnerability information, or even counter-terrorism information. You can select up to three MISP sources, Client A, Client B, and Client C, to set up multiple connections to different MISP endpoints.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL PHONE_NUMBER FILENAME BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	MISP server URL Authentication key
Recorded Future Threat Intelligence Domain	Provides a list of up to 100,000 malicious domains with risk scores above 65.	Feed-based	1440 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL	Recorded Future Premium subscription API key Recorded Future credits for list updates
Recorded Future Threat Intelligence Hash	Provides a list of up to 100,000 malicious hashes with risk scores above 65.	Feed-based	1440 minutes	MD5 SHA1 SHA256	Recorded Future Premium subscription API key Recorded Future credits for list updates
Recorded Future Threat Intelligence IP	Provides a list of up to 100,000 malicious IP addresses with risk scores above 65.	Feed-based	1440 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK BITCOIN_ADDRESS SOFTWARE EMAIL_ADDRESS REGISTRY_KEY	Recorded Future Premium subscription API key Recorded Future credits for list updates
Recorded Future Threat Intelligence URL	Provides a list of up to 100,000 malicious URLs with risk scores above 65.	Feed-based	1440 minutes	DOMAIN URL	Recorded Future Premium subscription API key Recorded Future credits for list updates
TAXII v1	Allows users to normalize intelligence from STIX-TAXII supported tools and leverage high-fidelity Indicators within workflow tools. You can select up to three TAXII v1 sources, Client A, Client B, and Client C, to set up multiple connections to different TAXII v1 endpoints.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK REGISTRY_KEY SOFTWARE EMAIL_ADDRESS	TAXII server URL API credentials PEM file contents TAXII server collections
TAXii v2	Allows users to normalize intelligence from STIX-TAXII supported tools and leverage high-fidelity Indicators within workflow tools. You can select up to three TAXII v2 sources, Client A, Client B, and Client C, to set up multiple connections to different TAXII v2 endpoints.	Feed-based	15 minutes	MD5 SHA1 SHA256 IP4 IP6 DOMAIN URL CIDR_BLOCK REGISTRY_KEY SOFTWARE EMAIL_ADDRESS	TAXII server URL API credentials PEM file contents TAXII server collections