{"id":802,"date":"2020-10-04T18:29:19","date_gmt":"2020-10-04T10:29:19","guid":{"rendered":"https:\/\/cybersecthreat.com\/?p=802"},"modified":"2024-04-01T13:48:46","modified_gmt":"2024-04-01T05:48:46","slug":"splunk_local_threat_intel","status":"publish","type":"post","link":"https:\/\/cybersecthreat.com\/zh\/2020\/10\/04\/splunk_local_threat_intel\/","title":{"rendered":"Splunk local threat intel"},"content":{"rendered":"<p>Why yet another Splunk local threat intel article ? Obviously, there are many excellent articles: <\/p>\n\n\n\n<ul class=\"wp-block-list\" id=\"block-c98e2413-c0b4-4cbe-a3bc-8dfebf383e1b\">\n<li><a href=\"https:\/\/dev.splunk.com\/enterprise\/docs\/devtools\/enterprisesecurity\/threatintelligenceframework\/\">Threat Intelligence framework in Splunk ES<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/conf.splunk.com\/files\/2017\/slides\/enterprise-security-biology-dissecting-the-splunk-enterprise-security-threat-intelligence-framework.pdf\">Dissecting the Threat Intelligence Framework<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.splunk.com\/en_us\/blog\/security\/threat-intel-and-splunk-enterprise-security-part-1-what-s-the-point-of-threat-intel-in-es.html\">Threat Intel and Splunk Enterprise Security Part 1<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.splunk.com\/en_us\/blog\/security\/threat-intel-and-splunk-enterprise-security-part-2-adding-local-intel-to-enterprise-security.html\">Threat Intel and Splunk Enterprise Security Part 2<\/a><\/li>\n<\/ul>\n\n\n\n<p>Unlike other articles, we mainly focus on common operational issues of Splunk local threat intel usage including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Understand the impact of editing Splunk local threat intel csv lookup<\/li>\n\n\n\n<li>Removing Splunk local threat intel entry<\/li>\n<\/ul>\n\n\n<style>.kadence-column802_801b37-ee > .kt-inside-inner-col{display:flex;}.kadence-column802_801b37-ee > .kt-inside-inner-col,.kadence-column802_801b37-ee > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column802_801b37-ee > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column802_801b37-ee > .kt-inside-inner-col{flex-direction:column;align-items:center;}.kadence-column802_801b37-ee > .kt-inside-inner-col > .kb-image-is-ratio-size{align-self:stretch;}.kadence-column802_801b37-ee > .kt-inside-inner-col > .wp-block-kadence-advancedgallery{align-self:stretch;}.kadence-column802_801b37-ee > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column802_801b37-ee > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column802_801b37-ee{position:relative;}@media all and (max-width: 1024px){.kadence-column802_801b37-ee > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}@media all and (max-width: 767px){.kadence-column802_801b37-ee > .kt-inside-inner-col{flex-direction:column;justify-content:center;align-items:center;}}<\/style>\n<div class=\"wp-block-kadence-column kadence-column802_801b37-ee\"><div class=\"kt-inside-inner-col\"><style>.kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-table-of-content-wrap{padding-top:var(--global-kb-spacing-sm, 1.5rem);padding-right:var(--global-kb-spacing-sm, 1.5rem);padding-bottom:var(--global-kb-spacing-sm, 1.5rem);padding-left:0px;background-color:rgba(255,255,255,0.99);border-top:3px solid #313131;border-right:3px solid #313131;border-bottom:3px solid #313131;border-left:3px solid #313131;box-shadow:0px 0px 14px 0px #abb8c3;}.kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-table-of-contents-title-wrap{padding-top:0px;padding-right:0px;padding-bottom:0px;padding-left:0px;}.kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-table-of-contents-title{font-size:var(--global-kb-font-size-lg, 2rem);font-weight:bold;font-style:normal;}.kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-table-of-content-wrap .kb-table-of-content-list{color:#d65a02;font-size:var(--global-kb-font-size-md, 1.25rem);font-weight:regular;font-style:normal;margin-top:var(--global-kb-spacing-sm, 1.5rem);margin-right:0px;margin-bottom:0px;margin-left:0px;}.kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-toggle-icon-style-basiccircle .kb-table-of-contents-icon-trigger:after, .kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-toggle-icon-style-basiccircle .kb-table-of-contents-icon-trigger:before, .kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-toggle-icon-style-arrowcircle .kb-table-of-contents-icon-trigger:after, .kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-toggle-icon-style-arrowcircle .kb-table-of-contents-icon-trigger:before, .kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-toggle-icon-style-xclosecircle .kb-table-of-contents-icon-trigger:after, .kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-toggle-icon-style-xclosecircle .kb-table-of-contents-icon-trigger:before{background-color:rgba(255,255,255,0.99);}@media all and (max-width: 1024px){.kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-table-of-content-wrap{margin-left:var(--global-kb-spacing-auto, auto);border-top:3px solid #313131;border-right:3px solid #313131;border-bottom:3px solid #313131;border-left:3px solid #313131;}}@media all and (max-width: 767px){.kb-table-of-content-nav.kb-table-of-content-id802_107478-2d .kb-table-of-content-wrap{margin-left:var(--global-kb-spacing-auto, auto);border-top:3px solid #313131;border-right:3px solid #313131;border-bottom:3px solid #313131;border-left:3px solid #313131;}}<\/style><\/div><\/div>\n\n\n\n<p>Before we start to discuss those operational issues, let&#8217;s explore the workflow of threat intelligence framework. Basically, it consists of 4 phases:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Threat intelligence manager script firstly downloaded raw data. If it is threat related feed, manager script will further normalizes and stores it to different KV Store inside the Threat Collections.<\/li>\n\n\n\n<li>Multiple Threat &#8220;Lookup Gen&#8221; search transform non-threat raw files or threat collections KV Store to different csv files.<\/li>\n\n\n\n<li>Multiple &#8220;Threat Gen&#8221; scheduled search running <strong>tstats<\/strong> command to check matching values between output csv files from step 2 and different data model. In case &#8220;Threat Gen&#8221; search find a matching value, it will output to <strong>threat_activity<\/strong> index.<\/li>\n\n\n\n<li>Schedule &#8220;Threat Activity Detected&#8221; correlation search look for events in <strong>threat_activity<\/strong> index from step 3 and then generate notable events.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-threat-intelligence-manager\">Threat intelligence manager<\/h2>\n\n\n\n<p>In short, Threat intelligence manager is a python script located at DA-ESS-ThreatIntelligence\/bin\/threat_intelligence_manager.py. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-manager-stage-1-download-feeds\">Manager Stage 1 &#8211; download feeds<\/h3>\n\n\n\n<p>Firstly, manager will <strong>download<\/strong> feeds (<strong>including local threat intel<\/strong>) defined in <strong>inputs.conf<\/strong> based on the configured interval and store it into <strong>$SPLUNK_DB\/modinputs\/threatlist<\/strong> directory. As a result of Splunk Enterprise Security app installation, there are 2 different <strong>inputs.conf<\/strong> which can be located in <strong>DA-ESS-ThreatIntelligence<\/strong> \u53ca <strong>SA-ThreatIntelligence<\/strong> directory. <\/p>\n\n\n\n<p>Now, let&#8217;s take a look of default threat intelligence feed by navigating  Enterprise Security -&gt; Configure -&gt; Data Enrichment-&gt; Intelligence Downloads. Some of these feeds are disabled by default. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/09\/Splunk_Intelligence_Downloads.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"451\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/09\/Splunk_Intelligence_Downloads-1024x451.png\" alt=\"Splunk Intelligence Downloads\" class=\"wp-image-805\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/09\/Splunk_Intelligence_Downloads-1024x451.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/09\/Splunk_Intelligence_Downloads-300x132.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/09\/Splunk_Intelligence_Downloads-768x338.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/09\/Splunk_Intelligence_Downloads-600x264.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/09\/Splunk_Intelligence_Downloads.png 1289w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>Then, we will further check the detail configuration page, and notice the &#8220;<strong>Is Threat Intelligence<\/strong>&#8221; option. If this option is enabled, Splunk will further process the feed and save into Threat collection KV store. In fact, KV Store is key-value pair stored in MongoDB, which can be retrieved via <strong>inputlookup<\/strong> command.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"850\" height=\"482\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Intelligence_Download_Settings.png\" alt=\"Splunk Intelligence Download Settings\" class=\"wp-image-820\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Intelligence_Download_Settings.png 850w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Intelligence_Download_Settings-300x170.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Intelligence_Download_Settings-768x436.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Intelligence_Download_Settings-600x340.png 600w\" sizes=\"auto, (max-width: 850px) 100vw, 850px\" \/><\/figure>\n\n\n\n<p>By default, Splunk Enterprise Security comes with <strong>2<\/strong> main feed types:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Non-Threat Intelligence feeds (Log enrichment feeds or other feeds useful for use case development and investigation inside <strong><code>SA-ThreatIntelligence<\/code><\/strong> directory):\n<ul class=\"wp-block-list\">\n<li>cisco_top_one_million_sites (Cisco Umbrella 1 Million)<\/li>\n\n\n\n<li>alexa_top_one_million_sites (retired and no maintenance)<\/li>\n\n\n\n<li>MaxMind GeoIP ASN IPv4\/IPv6 database (Only support old database format)<\/li>\n\n\n\n<li>icann_top_level_domain_list<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Threat Intelligence feeds (inside <strong><code>DA-ESS-ThreatIntelligence<\/code><\/strong> directory)\n<ul class=\"wp-block-list\">\n<li>Common open source threat feeds including <strong>phishtank<\/strong>, <strong>zeus blacklists<\/strong><\/li>\n\n\n\n<li>Local threat intel csv file\n<ul class=\"wp-block-list\">\n<li>local_certificate_intel.csv<\/li>\n\n\n\n<li>local_domain_intel.csv<\/li>\n\n\n\n<li>local_email_intel.csv<\/li>\n\n\n\n<li>local_file_intel.csv<\/li>\n\n\n\n<li>local_http_intel.csv<\/li>\n\n\n\n<li>local_ip_intel.csv<\/li>\n\n\n\n<li>local_process_intel.csv<\/li>\n\n\n\n<li>local_registry_intel.csv<\/li>\n\n\n\n<li>local_service_intel.csv<\/li>\n\n\n\n<li>local_user_intel.csv<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p>Splunk now comes with both <strong>alexa_top_one_million_sites<\/strong> \u53ca <strong>cisco_top_one_million_sites<\/strong>. In fact, Splunk is moving to Cisco umbrella top 1 million feed as its default. However, we noticed some knowledge objects still reference to the OLD Alexa feed. Therefore, we recommended to replace the URL of Alexa with cisco umbrella top 1 million as 2 feeds are basically compatible.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-manager-stage-2-normalize-threat-feeds\">Manager Stage 2 &#8211; normalize threat feeds<\/h3>\n\n\n\n<p>Secondly, the script will normalize the downloaded raw file and stored it in different KV Store collections based on the field name if it is classified as &#8220;<strong>Is Threat Intelligence<\/strong>&#8220;. Those field name mapping are available in <strong>.\/DA-ESS-ThreatIntelligence\/default\/collections.conf<\/strong>. Below is a snippet for <strong>http_intel<\/strong> threat collection. Basically, if the field name inside threat intel feed matches the below field name (e.g. http_version, http_method), Splunk will save it into <strong>http_intel<\/strong> KV store. <\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>&#91;http_intel]\nfield.http_version              = string\nfield.http_method               = string\nfield.http_content_type         = string\nfield.http_referrer             = string\nfield.http_user_agent           = string\nfield.http_user_agent_length    = number\nfield.status                    = number\nfield.cookie                    = string\nfield.header                    = string\nfield.data                      = string\nfield.url                       = string\nfield.url_length                = number\nfield.uri_path                  = string\nfield.uri_query                 = string\nfield.ip                        = string\nfield.domain                    = string\nfield.description               = string\nfield.threat_key                = string\nfield.time                      = time\nfield.weight                    = number\nfield.disabled                  = bool\nfield.updated                   = bool<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>Furthermore, there is an interesting field &#8220;<strong>domain<\/strong>&#8221; defined in http_intel, ip_intel and certificate_intel collection. If we manually add a column named <strong>domain<\/strong> to the <strong>local_http_intel.csv<\/strong> file, Splunk will still process it. However, you will likely see the domain intel added to the <strong>ip_intel<\/strong> lookup instead of http_intel due to de-duplication process by manager script.<\/p>\n\n\n\n<p>Another thing worth to mention is &#8220;<code><strong>disabled<\/strong><\/code>&#8221; and &#8220;<strong><code>updated<\/code><\/strong>&#8221; field. Splunk will not process it even if you manually add these 2 columns.<\/p>\n\n\n\n<p>Below list threat related KV Store collections in <strong>collections.conf<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>http_intel<\/li>\n\n\n\n<li>ip_intel<\/li>\n\n\n\n<li>certificate_intel<\/li>\n\n\n\n<li>email_intel<\/li>\n\n\n\n<li>process_intel<\/li>\n\n\n\n<li>file_intel<\/li>\n\n\n\n<li>registry_intel<\/li>\n\n\n\n<li>service_intel<\/li>\n\n\n\n<li>user_intel<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-scenario-1-added-wrong-splunk-local-threat-intel\">Scenario 1 &#8211; Added wrong Splunk local threat intel<\/h4>\n\n\n\n<p>Let&#8217;s take an example editing local_domain_intel.csv. In our example, we use the Splunk lookup editor app available <a href=\"https:\/\/splunkbase.splunk.com\/app\/1724\/\">\u7db2\u5740<\/a>. Notice that we accidentally add &#8220;<em>gooddomain.com<\/em>&#8221; into local_domain_intel csv file.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/local_domain_intel_with_gooddomain.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"211\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/local_domain_intel_with_gooddomain-1024x211.png\" alt=\"local_domain_intel.csv with gooddomain\" class=\"wp-image-832\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/local_domain_intel_with_gooddomain-1024x211.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/local_domain_intel_with_gooddomain-300x62.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/local_domain_intel_with_gooddomain-768x158.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/local_domain_intel_with_gooddomain-600x124.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/local_domain_intel_with_gooddomain.png 1358w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>After several minutes, Splunk process local_domain_intel.csv and add those entries into <strong>ip_intel<\/strong> KV Store.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"274\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-1024x274.png\" alt=\"inputlookup ip_intel with gooddomain\" class=\"wp-image-833\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-1024x274.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-300x80.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-768x206.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-600x161.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain.png 1359w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>Next, we removed the entry <em>gooddomain.com<\/em>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_removed_gooddomain.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"179\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_removed_gooddomain-1024x179.png\" alt=\"lookup ip_intel removed gooddomain\" class=\"wp-image-834\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_removed_gooddomain-1024x179.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_removed_gooddomain-300x52.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_removed_gooddomain-768x134.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_removed_gooddomain-600x105.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_removed_gooddomain.png 1347w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>When we back to check the ip_intel KV Store, <em>gooddomain.com<\/em> is still there. I have actually seen some junior SOC analyst added the entire CDN domain into domain threat intel. <\/p>\n\n\n\n<p>In normal case, I think nobody always check the ip_intel, and you always discover this when &#8220;Threat Activity Detected&#8221; filling up the &#8220;Incident Review&#8221; page. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"274\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-1024x274.png\" alt=\"inputlookup ip_intel with gooddomain\" class=\"wp-image-833\" style=\"width:580px;height:155px\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-1024x274.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-300x80.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-768x206.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain-600x161.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/lookup_ip_intel_with_gooddomain.png 1359w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>One of solution to this situation is removing ALL <strong>local_domain_intel<\/strong> from ip_intel Threat Collection by using the following query. Then, we can remove the entry <em>gooddomain.com<\/em> in local_domain_intel.csv.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>| inputlookup ip_intel\n| search NOT threat_key=\"local_domain_intel\"\n| outputlookup ip_intel<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-scenario-2-using-asterisk-in-splunk-local-threat-intel\">Scenario 2 &#8211; Using asterisk in Splunk local threat intel<\/h4>\n\n\n\n<p>Let&#8217;s explore the local_http_intel.csv example. As a Splunker, you may think that first 2 entry make sense to you, but it may not work as expected. We will cover the effect of each entry in the following section.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_local_http_intel_sample.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"231\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_local_http_intel_sample-1024x231.png\" alt=\"splunk local_http_intel sample\" class=\"wp-image-882\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_local_http_intel_sample-1024x231.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_local_http_intel_sample-300x68.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_local_http_intel_sample-768x173.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_local_http_intel_sample-600x135.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_local_http_intel_sample.png 1345w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-threat-lookup-gen-search\">Threat &#8220;Lookup Gen&#8221; search<\/h2>\n\n\n\n<p>Splunk Enterprise Security comes with 2 types of lookup generation search, which is non-threat related (<strong>SA-ThreatIntelligence<\/strong>) and threat related (<strong>DA-ESS-ThreatIntelligence)<\/strong>. All these lookup gen search aimed to transform the source files to csv files used by other Splunk search. In addition, all these search with prefix &#8220;Threat&#8221; and suffix &#8220;Lookup Gen&#8221;.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-non-threat-related-lookup-gen\">Non-threat related lookup gen<\/h3>\n\n\n\n<p>We will take a look of below non-threat related lookup generation. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_non_threat_lookup_gen.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"469\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_non_threat_lookup_gen-1024x469.png\" alt=\"splunk non threat lookup gen\" class=\"wp-image-885\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_non_threat_lookup_gen-1024x469.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_non_threat_lookup_gen-300x137.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_non_threat_lookup_gen-768x351.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_non_threat_lookup_gen-600x275.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_non_threat_lookup_gen.png 1366w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>Let&#8217;s further check the query of &#8220;<strong>Threat &#8211; Alexa Top Sites &#8211; Lookup Gen<\/strong>&#8220;. <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>| inputintelligence `top_1m_sites` | outputlookup alexa_lookup_by_str | stats count<\/code><\/pre>\n\n\n\n<p>In the above query, we can see <strong>top_1m_sites<\/strong> enclosed with symbol `, and it  is a Splunk macro. We can check the query embedded inside the macro by navigating to Settings -&gt; Advanced search -&gt; Search macros.<\/p>\n\n\n\n<p>\u9019 <strong>top_1m_sites<\/strong> macro actually refers to <strong>cisco_top_one_million_sites<\/strong>. As I have said, non-threat related feeds are stored in <strong>$SPLUNK_DB\/modinputs\/threatlist<\/strong> directory without any transformation. This <strong>inputintelligence<\/strong> command reads the raw file <strong>cisco_top_one_million_sites<\/strong> inside <strong>$SPLUNK_DB\/modinputs\/threatlist<\/strong> directory and output somewhere. In addition, you may also notice the keyword alexa is still referenced by Splunk. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-threat-related-lookup-gen\">Threat related lookup gen<\/h3>\n\n\n\n<p>Next, we will move on to threat related lookup gen. As there are a lots threat related lookup gen, thus we select <strong>HTTP<\/strong> related threat lookup generation search to facilitate our discussion. One important thing is that ALL <strong>enabled<\/strong> &#8220;Lookup Gen&#8221; will still keep running even &#8220;Next Scheduled Time&#8221; is &#8220;none&#8221;.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threat_http_lookup_gen.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"491\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threat_http_lookup_gen-1024x491.png\" alt=\"splunk threat http lookup gen\" class=\"wp-image-884\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threat_http_lookup_gen-1024x491.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threat_http_lookup_gen-300x144.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threat_http_lookup_gen-768x368.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threat_http_lookup_gen-600x288.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threat_http_lookup_gen.png 1366w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>In order to explain the example mentioned in previous section, we selected 4 lookup gen in our discussion:<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>Threat - Threat Intelligence By HTTP User Agent - Lookup Gen\nThreat - Threat Intelligence By HTTP User Agent Wildcard - Lookup Gen\nThreat - Threat Intelligence By HTTP User Agent Wildcard - Lookup Gen\nThreat - Threat Intelligence By URL - Lookup Gen<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-threat-threat-intelligence-by-http-user-agent-lookup-gen\">Threat &#8211; Threat Intelligence By HTTP User Agent &#8211; Lookup Gen<\/h4>\n\n\n\n<p>Firstly, we will take a look of the base query of this lookup gen. As we can see, it contains 3 macros.<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>| `http_intel` | `exclude_disabled_entries` | `threatintel_outputlookup(http_user_agent)`<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>Let&#8217;s explore the mentioned 3 macro starting with <code><strong>`http_intel`<\/strong><\/code> first. Basically, it runs <code>inputlookup http_intel<\/code> and enrich some more fields.<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>inputlookup append=T http_intel | fillnull value=0 updated,disabled | `set_threat_collection_name(\"http_intel\")` | `get_threat_attribution_weight(threat_key)`<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>For the <code><strong>`exclude_disabled_entries`<\/strong><\/code> macro, it simply filters all row with value disabled=1.<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>where NOT disabled=1<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>Finally, <code><strong>`threatintel_outputlookup(http_user_agent)`<\/strong><\/code> is similar to <code>| fields http_user_agent outputlookup threatintel_by_http_user_agent<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>`threatintel_outputlookup(\"$field$\",\"threatintel_by_$field$\")`<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>So, how is the resulting csv <strong>threatintel_by_http_user_agent<\/strong> looks like? As we can seen below, the lookup do not contains other fields such as url and http_referrer, but only the field http_user_agent. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent_csv.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"223\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent_csv-1024x223.png\" alt=\"splunk threatintel_by_http_user_agent.csv\" class=\"wp-image-902\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent_csv-1024x223.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent_csv-300x65.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent_csv-768x167.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent_csv-600x131.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent_csv.png 1358w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-threat-threat-intelligence-by-http-user-agent-wildcard-lookup-gen\">Threat &#8211; Threat Intelligence By HTTP User Agent Wildcard &#8211; Lookup Gen<\/h4>\n\n\n\n<p>Secondly, we will check another lookup gen with a very close name. The only difference is it contains &#8220;<strong>Wildcard<\/strong>&#8221; keyword. The real difference behind is the final output destination is <strong>threatintel_by_http_user_agent_wildcard<\/strong>.<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>| `http_intel` | `exclude_disabled_entries` | `threatintel_outputlookup_wildcard(http_user_agent)`<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>Please note that the below <strong>threatintel_by_http_user_agent_wildcard.csv<\/strong> is screen is captured from Splunk Enterprise Security v5.3.1. As shown below, a wildcard appears in <strong>http_user_agent<\/strong> field as a result of row 1 in Scenario 2. At this point, I think every Splunker aware of the issue, which is notable event will be generated whenever <strong>http_user_agent<\/strong> is not empty. This issue is fixed since Splunk Enterprise Security v6.0, and field value with ONLY asterisk will not be populated to wildcard lookup table. <\/p>\n\n\n\n<p>Now, we can conclude 2 things of Splunk Threat intel framework:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Field value with wildcard and without wildcard are separated into 2 different lookup table<\/li>\n\n\n\n<li>Each field (e.g. http_user_agent, url) are distributed into different lookup table for further processing. In other words, the notable event will be generated because of a single field value, but not the combination of multiple field values.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent__wildcard_csv_531.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"152\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent__wildcard_csv_531-1024x152.png\" alt=\"splunk threatintel_by_http_user_agent__wildcard.csv 5.3.1\" class=\"wp-image-904\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent__wildcard_csv_531-1024x152.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent__wildcard_csv_531-300x44.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent__wildcard_csv_531-768x114.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent__wildcard_csv_531-600x89.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_http_user_agent__wildcard_csv_531.png 1357w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-threat-threat-intelligence-by-url-lookup-gen\">Threat &#8211; Threat Intelligence By URL &#8211; Lookup Gen<\/h4>\n\n\n\n<p>This lookup gen contains one additional macro  <code>`mvappend_field(url,http_referrer)`<\/code>, which effectively rename ALL http_referrer inside threat feed to <strong>url<\/strong> field. <\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>| `http_intel` | `exclude_disabled_entries` | `mvappend_field(url,http_referrer)` | `threatintel_outputlookup(url)`<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>If we check the resulting threatintel_by_url.csv, it contains only one entry. Therefore, do not expect any notable event due to http_referrer in raw log match the value in threat intel.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"169\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url-1024x169.png\" alt=\"splunk threatintel_by_url.csv\" class=\"wp-image-910\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url-1024x169.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url-300x50.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url-768x127.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url-600x99.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url.png 1362w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-threat-threat-intelligence-by-url-wildcard-lookup-gen\">Threat &#8211; Threat Intelligence By URL Wildcard &#8211; Lookup Gen<\/h4>\n\n\n\n<p>If you follow all the above 3 lookup gen section, you will understand how the following query works. <\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>| `http_intel` | `exclude_disabled_entries` | `mvappend_field(url,http_referrer)` | `threatintel_outputlookup_wildcard(url)`<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>One thing worth to discuss here is I usually recommended those SOC analyst to add wildcard to url field after the last characters so that we will not miss anything. Otherwise, splunk will only match the exact URL. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"225\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url_wildcard-1024x225.png\" alt=\"splunk threatintel_by_url_wildcard.csv\" class=\"wp-image-911\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url_wildcard-1024x225.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url_wildcard-300x66.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url_wildcard-768x169.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url_wildcard-600x132.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/splunk_threatintel_by_url_wildcard.png 1362w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-threat-gen-search\">&#8220;Threat Gen&#8221; search<\/h2>\n\n\n\n<p>In this section, we will cover &#8220;Threat Gen&#8221; search. In short, they are scheduled search with prefix &#8220;Threat&#8221; and suffix &#8220;Threat Gen&#8221; running tstats command to match threatintel csv lookup. You must explicit specific a data model when using tstats command.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Gen_Search.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"425\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Gen_Search-1024x425.png\" alt=\"Splunk Threat_Gen Search\" class=\"wp-image-935\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Gen_Search-1024x425.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Gen_Search-300x125.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Gen_Search-768x319.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Gen_Search-600x249.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Gen_Search.png 1359w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-splunk-data-model\">Splunk Data Model<\/h3>\n\n\n\n<p>Many SOC analyst comes to me and ask what is data model ? In short, Data Model groups the data with same kind of attributes and characteristics. You can also think of this is some kind of database schema. Splunk had already pre-built a <a href=\"https:\/\/splunkbase.splunk.com\/app\/1621\/\">CIM app<\/a> which comes with many excellent data model and field name. <\/p>\n\n\n\n<p>For instance, SOC usually ingest a lot of different raw log into SIEM system including proxy, firewall and IDS. These logs do not share the same attributes, but proxy log always share similar attributes. Therefore, Splunk defined a data model named Web and its attributes (url, http_user_agent and http_referrer). What you have to do is simply assign tag=web and tag=proxy to those proxy logs. Then, Splunk will automatically recognize those log as Web Data Model. <\/p>\n\n\n\n<p>In my experience, the design of Data Model always contribute to the success of SOC. Below list out some point worth to note:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data Model Acceleration\n<ul class=\"wp-block-list\">\n<li>An excellent feature to store summary data (NOT raw log) with reduced disk space.<\/li>\n\n\n\n<li>Not ALL Data Model are accelerated by default<\/li>\n\n\n\n<li>Useful for long term reporting and dashboard as the speed is excellent<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Data Model tag whitelist\n<ul class=\"wp-block-list\">\n<li>Each Data Model has its own tag whitelist. You must remember this when modifying existing data model. Do not directly edit configuration file. Please refer to <a href=\"https:\/\/docs.splunk.com\/Documentation\/CIM\/4.17.0\/User\/Setup\">link<\/a> here.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Use same field name\n<ul class=\"wp-block-list\">\n<li>Align to the field name used by Splunk when developing new app or new log type. It an significantly reduce the learning curve of SOC analyst.<\/li>\n\n\n\n<li>ALL the field name within Data Model are small capital<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Reuse of existing use-cases\/correlation rules\n<ul class=\"wp-block-list\">\n<li>If we have enabled &#8220;brute-force attack&#8221; using Authentication Data Model, detection will automatically take place whenever a new device is onboarded with correct data model and field name defined.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-threat-url-matches-threat-gen\">Threat &#8211; URL Matches &#8211; Threat Gen<\/h3>\n\n\n\n<p>Now, we will take a look of &#8220;Threat &#8211; URL Matches &#8211; Threat Gen&#8221; search. Basically, this search will only search threat intel within <strong>Web<\/strong> Data Model. So, do not expect it will look for elsewhere. <\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>| `tstats` values(sourcetype) as sourcetype,values(Web.src),values(Web.dest) from datamodel=Web.Web by Web.http_referrer | eval url='Web.http_referrer' | eval threat_match_field=\"http_referrer\" | `tstats` append=true values(sourcetype) as sourcetype,values(Web.src),values(Web.dest) from datamodel=Web.Web by Web.url | eval url=if(isnull(url),'Web.url',url) | eval threat_match_field=if(isnull(threat_match_field),\"url\",threat_match_field) | stats values(sourcetype) as sourcetype,values(Web.src) as src,values(Web.dest) as dest by url,threat_match_field | extract domain_from_url | `threatintel_url_lookup(url)` | `threatintel_domain_lookup(url_domain)` | search threat_collection_key=* | `mvtruncate(src)` | `mvtruncate(dest)` | `zipexpand_threat_matches`<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>There is another search &#8220;<strong>Threat &#8211; Source And Destination Matches &#8211; Threat Gen<\/strong>&#8221; which look for 3 data model. If you read through this article, I believe you can locate it yourself. Leave us a message if you encounter any issues.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-threat-activity-detected\">Threat Activity Detected<\/h2>\n\n\n\n<p>Finally, we comes to the last steps of Splunk Threat intel framework. There is not much to discuss here. The correlation rule &#8220;<strong>Threat Activity Detected<\/strong>&#8221; should simply works after enabled it. The &#8220;Incident Review&#8221; page will show the &#8220;Threat Source ID&#8221;, which indicate where the threat intel comes from. An SOC analyst should first check this field to determine their next step or maybe some junior analyst add a wrong records.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"479\" src=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected-1024x479.png\" alt=\"Splunk Threat Activity Detected\" class=\"wp-image-944\" srcset=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected-1024x479.png 1024w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected-300x140.png 300w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected-768x359.png 768w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected-600x280.png 600w, https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png 1333w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-additional-design-consideration\">Additional design consideration<\/h2>\n\n\n\n<p>In this final section, I want to cover some additional consideration when designing SIEM correlation rules. It is more general and not limited to &#8220;<strong>Threat Activity Detected<\/strong>&#8221; correlation rule.<\/p>\n\n\n\n<p>Generally speaking, each correlation rule is configured to search for events occurred within a certain period (e.g. from 1 hour ago to now). There is no issues if our world is perfect. In the real world, we do experience many issues such as indexer performance issues and cloud log delay issues. Of course, we cannot consider every situation, but at least if we know the logs from AWS is having an average of 20 minutes delay. Then, we have to consider about it. You can simply start to examine the reasonable earliest and latest value by the following query.<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<pre class=\"wp-block-code\"><code>index=*\n|  eval indextime=_indextime\n|  eval timediff=indextime-_time\n|  stats count, max(timediff), avg(timediff) by sourcetype, source, host<\/code><\/pre>\n<\/div><\/div>\n\n\n\n<p>Thanks very much to read this long long articles. Stay safe!<\/p>","protected":false},"excerpt":{"rendered":"<p>Why yet another Splunk local threat intel article ? Obviously, there are many excellent articles: Unlike other articles, we mainly focus on common operational issues of Splunk local threat intel usage including: Before we start to discuss those operational issues, let&#8217;s explore the workflow of threat intelligence framework. Basically, it consists of 4 phases: Threat&#8230;<\/p>","protected":false},"author":2,"featured_media":944,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[42,265,264,71,23,263],"tags":[21,261,260,74,73,20,262],"class_list":["post-802","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blue-team","category-cti","category-cyber-threat-intelligence","category-soc","category-splunk","category-threat-intelligence","tag-blue-team","tag-cti","tag-cyber-threat-intelligence","tag-siem","tag-soc","tag-splunk","tag-threat-intelligence"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Splunk local threat intel - CyberSecThreat<\/title>\n<meta name=\"description\" content=\"Understand the impact of editing Splunk local threat intel csv lookup &amp; Removing Splunk local threat intel entry\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cybersecthreat.com\/zh\/2020\/10\/04\/splunk_local_threat_intel\/\" \/>\n<meta property=\"og:locale\" content=\"zh_TW\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Splunk local threat intel\" \/>\n<meta property=\"og:description\" content=\"Why yet another Splunk local threat intel article ? Obviously, there are many excellent articles: Threat Intelligence framework in Splunk ES Dissecting\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybersecthreat.com\/zh\/2020\/10\/04\/splunk_local_threat_intel\/\" \/>\n<meta property=\"og:site_name\" content=\"CyberSecThreat\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cybersecthreat\" \/>\n<meta property=\"article:published_time\" content=\"2020-10-04T10:29:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-01T05:48:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1333\" \/>\n\t<meta property=\"og:image:height\" content=\"623\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Kelvin Yip\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cybersecthreat\" \/>\n<meta name=\"twitter:site\" content=\"@cybersecthreat\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kelvin Yip\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9810\u4f30\u95b1\u8b80\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 \u5206\u9418\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/\"},\"author\":{\"name\":\"Kelvin Yip\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/#\\\/schema\\\/person\\\/4787dde06da74fa66cb5e92e481b0f98\"},\"headline\":\"Splunk local threat intel\",\"datePublished\":\"2020-10-04T10:29:19+00:00\",\"dateModified\":\"2024-04-01T05:48:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/\"},\"wordCount\":2288,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cybersecthreat.com\\\/wp-content\\\/uploads\\\/2020\\\/10\\\/Splunk_Threat_Activity_Detected.png\",\"keywords\":[\"Blue Team\",\"CTI\",\"Cyber Threat Intelligence\",\"SIEM\",\"SOC\",\"Splunk\",\"Threat Intelligence\"],\"articleSection\":[\"Blue Team\",\"CTI\",\"Cyber Threat Intelligence\",\"SOC\",\"Splunk\",\"Threat Intelligence\"],\"inLanguage\":\"zh-TW\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/\",\"url\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/\",\"name\":\"Splunk local threat intel - CyberSecThreat\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cybersecthreat.com\\\/wp-content\\\/uploads\\\/2020\\\/10\\\/Splunk_Threat_Activity_Detected.png\",\"datePublished\":\"2020-10-04T10:29:19+00:00\",\"dateModified\":\"2024-04-01T05:48:46+00:00\",\"description\":\"Understand the impact of editing Splunk local threat intel csv lookup & Removing Splunk local threat intel entry\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#breadcrumb\"},\"inLanguage\":\"zh-TW\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cybersecthreat.com\\\/wp-content\\\/uploads\\\/2020\\\/10\\\/Splunk_Threat_Activity_Detected.png\",\"contentUrl\":\"https:\\\/\\\/cybersecthreat.com\\\/wp-content\\\/uploads\\\/2020\\\/10\\\/Splunk_Threat_Activity_Detected.png\",\"width\":1333,\"height\":623,\"caption\":\"Splunk Threat Activity Detected\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"SOC\",\"item\":\"https:\\\/\\\/cybersecthreat.com\\\/category\\\/soc\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Splunk local threat intel\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/#website\",\"url\":\"https:\\\/\\\/cybersecthreat.com\\\/\",\"name\":\"CyberSecThreat\",\"description\":\"CyberSecurity Solutions\",\"publisher\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cybersecthreat.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-TW\"},{\"@type\":[\"Organization\",\"Place\"],\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/#organization\",\"name\":\"CyberSecThreat Corporation Limited.\",\"alternateName\":\"CyberSecThreat\",\"url\":\"https:\\\/\\\/cybersecthreat.com\\\/\",\"logo\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#local-main-organization-logo\"},\"image\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#local-main-organization-logo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cybersecthreat\",\"https:\\\/\\\/x.com\\\/cybersecthreat\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cybersecthreat-corporation-limited\"],\"description\":\"CyberSecThreat, headquartered in Taiwan, is a Cybersecurity solutions provider that offers cutting-edge Cybersecurity solutions including Cyber Threat Intelligence (CTI), Security Orchestration, Automation, and Response (SOAR), UBA\\\/UEBA, DFIR, and CyberSecurity consulting. CyberSecThreat was awarded as Top 10 Cyber Security Companies of 2022 in APAC CIO Outlook\u2019s Cyber Security Edition. We position ourselves as one of the most comprehensive players in the most advanced high-end marketplace with our highly customizable cybersecurity solutions. CyberSecThreat has been committed to contributing to the CyberSecurity industry and assisting our global clients to improve their CyberSecurity posture. With our global partners and experts, we can deliver a wide range of world-class services to our global clients including vCISO, SOC consulting, Splunk consulting, red team, blue team, and AppSec consulting. CyberSecThreat Research Lab, which is led by our founder Kelvin Yip, is a subdivision that focuses on researching Cyber Warfare, Cyber Influence Operation\\\/Cognitive Domain Warfare (including Disinformation, Propaganda, and psychological manipulation), the latest Cybersecurity trends, and threats that organizations face today as well as technology innovation. With decades of Cybersecurity and technology experience, our teams of experts carry out research and experiment, bringing it to the real world. When things come to the real world and production environment, it is more complicated than our imagination. Let us worry about it because this is our mission! Our vision: NextGen safe digital life, and our mission is to Transform Security Into Real World.\",\"legalName\":\"CyberSecThreat Corporation Limited.\",\"foundingDate\":\"2021-01-23\",\"address\":{\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#local-main-place-address\"},\"geo\":{\"@type\":\"GeoCoordinates\",\"latitude\":\"25.0600452\",\"longitude\":\"121.4594381\"},\"telephone\":[\"(+886) 02 - 77527628\"],\"openingHoursSpecification\":[{\"@type\":\"OpeningHoursSpecification\",\"dayOfWeek\":[\"Monday\",\"Tuesday\",\"Wednesday\",\"Thursday\",\"Friday\",\"Saturday\",\"Sunday\"],\"opens\":\"09:00\",\"closes\":\"18:00\"}],\"email\":\"info@cybersecthreat.com\",\"areaServed\":\"Taiwan\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/#\\\/schema\\\/person\\\/4787dde06da74fa66cb5e92e481b0f98\",\"name\":\"Kelvin Yip\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/91aef1abe820d485df4dc03c80c4bab5b129b723fea7002f20904634c1042d21?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/91aef1abe820d485df4dc03c80c4bab5b129b723fea7002f20904634c1042d21?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/91aef1abe820d485df4dc03c80c4bab5b129b723fea7002f20904634c1042d21?s=96&d=mm&r=g\",\"caption\":\"Kelvin Yip\"},\"sameAs\":[\"https:\\\/\\\/cybersecthreat.com\"],\"knowsAbout\":[\"CyberSecurity\"],\"knowsLanguage\":[\"English\",\"Chinese\"],\"jobTitle\":\"Founder, CEO\",\"url\":\"https:\\\/\\\/cybersecthreat.com\\\/zh\\\/author\\\/kelvinyip-m\\\/\"},{\"@type\":\"PostalAddress\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#local-main-place-address\",\"streetAddress\":\"9 F.-A6, No. 601, Siyuan Rd., Xinzhuang Dist., New Taipei City 242032, Taiwan (R.O.C.)\",\"addressLocality\":\"New Taipei City\",\"postalCode\":\"242032\",\"addressRegion\":\"Taiwan\",\"addressCountry\":\"TW\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-TW\",\"@id\":\"https:\\\/\\\/cybersecthreat.com\\\/2020\\\/10\\\/04\\\/splunk_local_threat_intel\\\/#local-main-organization-logo\",\"url\":\"https:\\\/\\\/cybersecthreat.com\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/CyberSecThreat_website-site-logo-_164x164-min.png\",\"contentUrl\":\"https:\\\/\\\/cybersecthreat.com\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/CyberSecThreat_website-site-logo-_164x164-min.png\",\"width\":164,\"height\":164,\"caption\":\"CyberSecThreat Corporation Limited.\"}]}<\/script>\n<meta name=\"geo.placename\" content=\"New Taipei City\" \/>\n<meta name=\"geo.position\" content=\"25.0600452;121.4594381\" \/>\n<meta name=\"geo.region\" content=\"Taiwan\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Splunk local threat intel - CyberSecThreat","description":"Understand the impact of editing Splunk local threat intel csv lookup & Removing Splunk local threat intel entry","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cybersecthreat.com\/zh\/2020\/10\/04\/splunk_local_threat_intel\/","og_locale":"zh_TW","og_type":"article","og_title":"Splunk local threat intel","og_description":"Why yet another Splunk local threat intel article ? Obviously, there are many excellent articles: Threat Intelligence framework in Splunk ES Dissecting","og_url":"https:\/\/cybersecthreat.com\/zh\/2020\/10\/04\/splunk_local_threat_intel\/","og_site_name":"CyberSecThreat","article_publisher":"https:\/\/www.facebook.com\/cybersecthreat","article_published_time":"2020-10-04T10:29:19+00:00","article_modified_time":"2024-04-01T05:48:46+00:00","og_image":[{"width":1333,"height":623,"url":"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png","type":"image\/png"}],"author":"Kelvin Yip","twitter_card":"summary_large_image","twitter_creator":"@cybersecthreat","twitter_site":"@cybersecthreat","twitter_misc":{"\u4f5c\u8005:":"Kelvin Yip","\u9810\u4f30\u95b1\u8b80\u6642\u9593":"13 \u5206\u9418"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#article","isPartOf":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/"},"author":{"name":"Kelvin Yip","@id":"https:\/\/cybersecthreat.com\/#\/schema\/person\/4787dde06da74fa66cb5e92e481b0f98"},"headline":"Splunk local threat intel","datePublished":"2020-10-04T10:29:19+00:00","dateModified":"2024-04-01T05:48:46+00:00","mainEntityOfPage":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/"},"wordCount":2288,"commentCount":0,"publisher":{"@id":"https:\/\/cybersecthreat.com\/#organization"},"image":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#primaryimage"},"thumbnailUrl":"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png","keywords":["Blue Team","CTI","Cyber Threat Intelligence","SIEM","SOC","Splunk","Threat Intelligence"],"articleSection":["Blue Team","CTI","Cyber Threat Intelligence","SOC","Splunk","Threat Intelligence"],"inLanguage":"zh-TW","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/","url":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/","name":"Splunk local threat intel - CyberSecThreat","isPartOf":{"@id":"https:\/\/cybersecthreat.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#primaryimage"},"image":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#primaryimage"},"thumbnailUrl":"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png","datePublished":"2020-10-04T10:29:19+00:00","dateModified":"2024-04-01T05:48:46+00:00","description":"Understand the impact of editing Splunk local threat intel csv lookup & Removing Splunk local threat intel entry","breadcrumb":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#breadcrumb"},"inLanguage":"zh-TW","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/"]}]},{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#primaryimage","url":"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png","contentUrl":"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected.png","width":1333,"height":623,"caption":"Splunk Threat Activity Detected"},{"@type":"BreadcrumbList","@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"SOC","item":"https:\/\/cybersecthreat.com\/category\/soc\/"},{"@type":"ListItem","position":2,"name":"Splunk local threat intel"}]},{"@type":"WebSite","@id":"https:\/\/cybersecthreat.com\/#website","url":"https:\/\/cybersecthreat.com\/","name":"\u5947\u8cc7\u5b89","description":"\u7db2\u8def\u5b89\u5168\u65b9\u6848","publisher":{"@id":"https:\/\/cybersecthreat.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybersecthreat.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-TW"},{"@type":["Organization","Place"],"@id":"https:\/\/cybersecthreat.com\/#organization","name":"\u5947\u8cc7\u8a0a\u4fdd\u5b89\u53ca\u7db2\u7d61\u6709\u9650\u516c\u53f8","alternateName":"CyberSecThreat","url":"https:\/\/cybersecthreat.com\/","logo":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#local-main-organization-logo"},"image":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#local-main-organization-logo"},"sameAs":["https:\/\/www.facebook.com\/cybersecthreat","https:\/\/x.com\/cybersecthreat","https:\/\/www.linkedin.com\/company\/cybersecthreat-corporation-limited"],"description":"CyberSecThreat, headquartered in Taiwan, is a Cybersecurity solutions provider that offers cutting-edge Cybersecurity solutions including Cyber Threat Intelligence (CTI), Security Orchestration, Automation, and Response (SOAR), UBA\/UEBA, DFIR, and CyberSecurity consulting. CyberSecThreat was awarded as Top 10 Cyber Security Companies of 2022 in APAC CIO Outlook\u2019s Cyber Security Edition. We position ourselves as one of the most comprehensive players in the most advanced high-end marketplace with our highly customizable cybersecurity solutions. CyberSecThreat has been committed to contributing to the CyberSecurity industry and assisting our global clients to improve their CyberSecurity posture. With our global partners and experts, we can deliver a wide range of world-class services to our global clients including vCISO, SOC consulting, Splunk consulting, red team, blue team, and AppSec consulting. CyberSecThreat Research Lab, which is led by our founder Kelvin Yip, is a subdivision that focuses on researching Cyber Warfare, Cyber Influence Operation\/Cognitive Domain Warfare (including Disinformation, Propaganda, and psychological manipulation), the latest Cybersecurity trends, and threats that organizations face today as well as technology innovation. With decades of Cybersecurity and technology experience, our teams of experts carry out research and experiment, bringing it to the real world. When things come to the real world and production environment, it is more complicated than our imagination. Let us worry about it because this is our mission! Our vision: NextGen safe digital life, and our mission is to Transform Security Into Real World.","legalName":"CyberSecThreat Corporation Limited.","foundingDate":"2021-01-23","address":{"@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#local-main-place-address"},"geo":{"@type":"GeoCoordinates","latitude":"25.0600452","longitude":"121.4594381"},"telephone":["(+886) 02 - 77527628"],"openingHoursSpecification":[{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday","Sunday"],"opens":"09:00","closes":"18:00"}],"email":"info@cybersecthreat.com","areaServed":"Taiwan"},{"@type":"Person","@id":"https:\/\/cybersecthreat.com\/#\/schema\/person\/4787dde06da74fa66cb5e92e481b0f98","name":"Kelvin Yip","image":{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/secure.gravatar.com\/avatar\/91aef1abe820d485df4dc03c80c4bab5b129b723fea7002f20904634c1042d21?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/91aef1abe820d485df4dc03c80c4bab5b129b723fea7002f20904634c1042d21?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/91aef1abe820d485df4dc03c80c4bab5b129b723fea7002f20904634c1042d21?s=96&d=mm&r=g","caption":"Kelvin Yip"},"sameAs":["https:\/\/cybersecthreat.com"],"knowsAbout":["CyberSecurity"],"knowsLanguage":["English","Chinese"],"jobTitle":"Founder, CEO","url":"https:\/\/cybersecthreat.com\/zh\/author\/kelvinyip-m\/"},{"@type":"PostalAddress","@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#local-main-place-address","streetAddress":"9 F.-A6, No. 601, Siyuan Rd., Xinzhuang Dist., New Taipei City 242032, Taiwan (R.O.C.)","addressLocality":"New Taipei City","postalCode":"242032","addressRegion":"Taiwan","addressCountry":"TW"},{"@type":"ImageObject","inLanguage":"zh-TW","@id":"https:\/\/cybersecthreat.com\/2020\/10\/04\/splunk_local_threat_intel\/#local-main-organization-logo","url":"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2023\/12\/CyberSecThreat_website-site-logo-_164x164-min.png","contentUrl":"https:\/\/cybersecthreat.com\/wp-content\/uploads\/2023\/12\/CyberSecThreat_website-site-logo-_164x164-min.png","width":164,"height":164,"caption":"CyberSecThreat Corporation Limited."}]},"geo.placename":"New Taipei City","geo.position":{"lat":"25.0600452","long":"121.4594381"},"geo.region":"Taiwan"},"taxonomy_info":{"category":[{"value":42,"label":"Blue Team"},{"value":265,"label":"CTI"},{"value":264,"label":"Cyber Threat Intelligence"},{"value":71,"label":"SOC"},{"value":23,"label":"Splunk"},{"value":263,"label":"Threat Intelligence"}],"post_tag":[{"value":21,"label":"Blue Team"},{"value":261,"label":"CTI"},{"value":260,"label":"Cyber Threat Intelligence"},{"value":74,"label":"SIEM"},{"value":73,"label":"SOC"},{"value":20,"label":"Splunk"},{"value":262,"label":"Threat Intelligence"}]},"featured_image_src_large":["https:\/\/cybersecthreat.com\/wp-content\/uploads\/2020\/10\/Splunk_Threat_Activity_Detected-1024x479.png",1024,479,true],"author_info":{"display_name":"Kelvin Yip","author_link":"https:\/\/cybersecthreat.com\/zh\/author\/kelvinyip-m\/"},"comment_info":0,"category_info":[{"term_id":42,"name":"Blue Team","slug":"blue-team","term_group":0,"term_taxonomy_id":42,"taxonomy":"category","description":"","parent":0,"count":14,"filter":"raw","cat_ID":42,"category_count":14,"category_description":"","cat_name":"Blue Team","category_nicename":"blue-team","category_parent":0},{"term_id":265,"name":"CTI","slug":"cti","term_group":0,"term_taxonomy_id":265,"taxonomy":"category","description":"","parent":0,"count":10,"filter":"raw","cat_ID":265,"category_count":10,"category_description":"","cat_name":"CTI","category_nicename":"cti","category_parent":0},{"term_id":264,"name":"Cyber Threat Intelligence","slug":"cyber-threat-intelligence","term_group":0,"term_taxonomy_id":264,"taxonomy":"category","description":"","parent":0,"count":10,"filter":"raw","cat_ID":264,"category_count":10,"category_description":"","cat_name":"Cyber Threat Intelligence","category_nicename":"cyber-threat-intelligence","category_parent":0},{"term_id":71,"name":"SOC","slug":"soc","term_group":0,"term_taxonomy_id":71,"taxonomy":"category","description":"","parent":0,"count":3,"filter":"raw","cat_ID":71,"category_count":3,"category_description":"","cat_name":"SOC","category_nicename":"soc","category_parent":0},{"term_id":23,"name":"Splunk","slug":"splunk","term_group":0,"term_taxonomy_id":23,"taxonomy":"category","description":"","parent":0,"count":10,"filter":"raw","cat_ID":23,"category_count":10,"category_description":"","cat_name":"Splunk","category_nicename":"splunk","category_parent":0},{"term_id":263,"name":"Threat Intelligence","slug":"threat-intelligence","term_group":0,"term_taxonomy_id":263,"taxonomy":"category","description":"","parent":0,"count":10,"filter":"raw","cat_ID":263,"category_count":10,"category_description":"","cat_name":"Threat Intelligence","category_nicename":"threat-intelligence","category_parent":0}],"tag_info":[{"term_id":21,"name":"Blue Team","slug":"blue-team","term_group":0,"term_taxonomy_id":21,"taxonomy":"post_tag","description":"","parent":0,"count":13,"filter":"raw"},{"term_id":261,"name":"CTI","slug":"cti","term_group":0,"term_taxonomy_id":261,"taxonomy":"post_tag","description":"","parent":0,"count":9,"filter":"raw"},{"term_id":260,"name":"Cyber Threat Intelligence","slug":"cyber-threat-intelligence","term_group":0,"term_taxonomy_id":260,"taxonomy":"post_tag","description":"","parent":0,"count":10,"filter":"raw"},{"term_id":74,"name":"SIEM","slug":"siem","term_group":0,"term_taxonomy_id":74,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"},{"term_id":73,"name":"SOC","slug":"soc","term_group":0,"term_taxonomy_id":73,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"},{"term_id":20,"name":"Splunk","slug":"splunk","term_group":0,"term_taxonomy_id":20,"taxonomy":"post_tag","description":"","parent":0,"count":8,"filter":"raw"},{"term_id":262,"name":"Threat Intelligence","slug":"threat-intelligence","term_group":0,"term_taxonomy_id":262,"taxonomy":"post_tag","description":"","parent":0,"count":10,"filter":"raw"}],"_links":{"self":[{"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/posts\/802","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/comments?post=802"}],"version-history":[{"count":0,"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/posts\/802\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/media\/944"}],"wp:attachment":[{"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/media?parent=802"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/categories?post=802"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecthreat.com\/zh\/wp-json\/wp\/v2\/tags?post=802"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}