Harness Cisco Talos Intelligence in Splunk SOAR (Cloud)

Release notes

For detailed release notes, see Cisco Talos Intelligence in Splunkbase, then select the Version History tab.

Cisco Talos overview

Cisco Talos is the threat intelligence division of Cisco, specializing in identifying, analyzing, and mitigating cybersecurity threats. Cisco Talos conducts deep malware analysis, reverse engineering, and vulnerability assessments to detect emerging threats. Cisco Talos creates and distributes threat intelligence updates to protect customers in real-time. Cisco Talos also collaborates with global partners to share insights and develop comprehensive defense strategies, ensuring robust protection against evolving cyber threats.

For additional information about Cisco Talos, see the Cisco Talos Intelligence web site.

Cisco Talos Intelligence functions and use cases

The Cisco Talos Intelligence provides the following core actions in your Splunk SOAR playbooks:

• IP reputation lookup
• Domain reputation lookup
• URL reputation lookup

You can use these actions to address a variety of use cases, including:

• Automating threat validation in phishing investigations.
• Enriching security alerts with actionable threat intelligence.
• Enhancing incident triage through real-time threat lookups.

Use Cisco Talos Intelligence in Splunk SOAR playbooks

Leverage Cisco Talos intelligence information in action blocks within Splunk SOAR playbooks.

For detailed information on how to use Cisco Talos Intelligence, see the README.md file in GitHub.

For detailed information on creating playbooks and using action blocks in playbooks, see the following documentation:

• Use Data Preview to build, test, and edit Splunk SOAR (Cloud) playbooks
• Add an action block to your Splunk SOAR (Cloud) playbook

Sample playbook

Get started immediately, using this sample playbook created with Cisco Talos Intelligence. Save this playbook and customize it to suit your organization's needs.

• CiscoTalosIntelligence_Identifier_Reputation_Analysis: Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and Acceptable Use Policy categories that are formatted and added to a container as a note.

See also

Cisco Talos Intelligence for Splunk Enterprise Security (Cloud Only) in the Use Splunk Enterprise Security documentation.