You can see threat intelligence data only if your admin has set up Threat Intelligence Management (Cloud) for your organization. For information on configuring Threat Intelligence Management (Cloud), see Overview of threat intelligence in Splunk Enterprise Security.

Fields containing observables in Splunk Enterprise Security

Some findings and investigations have specific fields that contain observables.

For example, a finding that you're triaging might contain one or more observables, such as a URL. If that URL has been reported by intelligence sources in active threat lists from the Threat Intelligence Management (Cloud) system, then you can find any threat intelligence attributes on that URL in the side panel of the analyst queue.

Similarly, investigations can contain observables with added context, such as priority scores, which you can use to advance that investigation and enhance your security monitoring capabilities.

Findings and investigations can contain observables from the following fields:

• host
• orig_host
• dvc
• dest
• src
• src_user
• user
• cve
• dest_dns
• dest_ip
• dest_nt_domain
• dest_nt_host
• dest_translated_ip
• dns
• dvc_dns
• dvc_ip
• dvc_nt_host
• file_hash
• file_name
• file_path
• hash
• ip
• nt_host
• orig_host
• orig_host_dns
• orig_host_ip
• orig_host_nt_host
• path
• recipient
• sender
• src_dns
• src_ip
• src_nt_domain
• src_nt_host
• src_user_email
• src_user_identity
• src_user_id
• threat_ip
• url
• user_email
• user_identity
• user_id
• threat_source_path
• risk_object
• risk_object_type
• threat_object
• threat_object_type
• threat_match_value
• threat_match_field

Some of these fields require other fields in order for intelligence data to appear in the intelligence tab of an investigation. Those fields are as follows:

• risk_object requires risk_object_type
• threat_object requires threat_object_type
• threat_match_value requires threat_match_field

See also

For more details on threat intelligence in Splunk Enterprise Security, see the product documentation:

• Overview of threat intelligence in Splunk Enterprise Security
• Triage findings and finding groups in Splunk Enterprise Security
• Start investigations in Splunk Enterprise Security
• Configure threat lists in Splunk Enterprise Security
• Investigate observables related to an investigation in Splunk Enterprise Security