Use the inputintelligence command to use generic intelligence in Splunk Enterprise Security
After you add generic intelligence to Splunk Enterprise Security using the threat intelligence management system, you can use the inputintelligence command to make use of the intelligence in Search Processing Language (SPL) pipelines.
The inputintelligence command cannot be used with threat intelligence sources.
Description
Use the inputintelligence command to add intelligence from the threatlist directory to your search results. When downloaded, generic intelligence is parsed and stored in the $SPLUNK_DB/modinputs/threatlist directory.
Run the inputintelligence command on the search head where the input is configured within a search head cluster environment. Searches may fail if you run the inputintelligence command on search peers in a search head cluster.
Syntax
| inputintelligence <threatlist_stanza_name> [fields=<string>] [delim_regex=<string>] [extract_regex=<string>] [ignore_regex=<string>] [skip_header_lines=<int>] [include_raw=<bool>] [append=<bool>] [no_parse=<bool>]
Required arguments
threatlist_stanza_name
- Syntax: <string>
- Description: The stanza of the intelligence download. Matches the Name field on the Intelligence Downloads page. You cannot have mutiple stanzas in in one search. Instead, you can combine multiple
inputintelligencecommands together and append the results with theappend=1argument.
Optional arguments
fields
- Syntax: <string>
- Description: Overrides the default fields setting for the intelligence download defined in the Intelligence Download page. Required if your document is line-delimited. Comma-separated list of fields to be extracted from the intelligence list. Can also be used to rename or combine fields. Description is a required field. Additional acceptable fields are the fields in the corresponding KV Store collection for the threat intelligence, visible in the local lookup files or the
DA-ESS-ThreatIntelligence/collections.confconfiguration file. No default value. If there is no value specified, thefieldsargument is parsed from the header of the CSV file. The list of fields can have any name and are not required to map to KV Store collections in theDA-ESS-ThreatIntelligence/collections.confconfiguration file.
delim_regex
- Syntax: <string>
- Description: Overrides the default delimiting regular expression setting for the intelligence download defined in the Intelligence Download page. A regular expression string used to split, or delimit, lines in an intelligence source. For complex delimiters, use an extracting regular expression.
extract_regex
- Syntax: <string>
- Description: Overrides the default extracting regular expression setting for the intelligence download defined in the Intelligence Download page. A regular expression used to extract fields from individual lines of an intelligence source document. Use to extract values in the intelligence source.
ignore_regex
- Syntax: <string>
- Description: Overrides the default ignore regular expression setting for the intelligence download defined in the Intelligence Download page. A regular expression used to ignore lines in an intelligence source. Defaults to ignoring blank lines and comments that begin with #.
skip_header_lines
- Syntax: <int>
- Description: Overrides the default skip header lines setting for the intelligence download defined in the Intelligence Download page. The number of header lines to skip when processing the intelligence source.
- Default: 0
include_raw
- Syntax: <bool>
- Description: If 1, t, or true, adds the original line content to an additional column called raw.
- Default: 0
append
- Syntax: <bool>
- Description: If 1, t, or true, appends the results of the
inputintelligencecommand to an existing set of search results instead of replacing it. - Default: 0
no_parse
- Syntax: <bool>
- Description: If 1, t, or true all other options are ignored and the raw contents of the intelligence file is returned one line per row.
- Default: 0
Usage
The inputintelligence command is a transforming command.
Example
View the top one million sites according to Cisco.
| inputintelligence cisco_top_one_million_sites
See also
| Modify existing intelligence sources in Splunk Enterprise Security | Create and manage safelist libraries in Splunk Enterprise Security |
This documentation applies to the following versions of Splunk® Enterprise Security: 8.0.0, 8.0.1
Download manual
Feedback submitted, thanks!