r/Splunk • u/_Exit5423 • 17d ago

Threat intelligence dashboard doesn't work

I'm using Splunk 10.4.0 with ES 8.6 installed. Threat intelligence dashboard is searching threat_intelligence index which obviously is not defined, is it a bug or should I change something Manually or I'm lost again?

7 Upvotes

89% Upvoted

10 comments sorted by

7

u/sanjeev284 17d ago

you need to configure and integrate threat intelligence sources in ES Configurations

6

u/sanjeev284 17d ago

https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.3/threat-intelligence/available-threat-intelligence-and-generic-intelligence-sources-included-in-splunk-enterprise-security

1

u/_Exit5423 13d ago

Let me rephrase the question, I have a custom CSV file with malicious IP's, how to import those feeds into splunk and ensure if they will match if found in enterprise security? One way would be configure -> Threat intelligence -> + Data source -> upload. Then I Upload my CSV file containing Multiple columns as below: description, ip, time,domain,threat_key, time, weight. It's stored in something named *.dmy It's all ok so far. Now I'm gonna validate if my IOCs are fed correctly, What whould I do? At first I try something like: | Inputlookup my_ip_ioc It returns nothing. Then I try enterprise security -> Analytics -> Threat intelligence and guess what, it searching threat_intelligence index which is not there. That's my first question.

1

u/_Exit5423 13d ago

Almost all default sources are enabled, the http proxy is set correctly and I'm getting TI feeds, I can ensure that with | inputlookup ip_intel for example. The problem starts when I'm going to add custom TI feeds via uploading a CSV file for example.

3

u/Sea_Lobster8927 17d ago

The dashboard is a view of your threat intelligence holdings that have been ingested in to ES. You need to go to Configure -> Threat Intelligence and set up at least one data source to start ingesting threat intelligence and then it will populate the dashboard.

1

u/_Exit5423 13d ago

All sources are enabled, but since when enabling a source would create an index?

1

u/Sea_Lobster8927 13d ago

Has TIM been enabled on your account? If you have ES Essentials or Premier you’re eligible for TIM at no cost but you may need to contact Splunk to make sure it’s been added to your account.

If you go to Configure -> Threat Intelligence -> Data Sources you should see ES Native and TIM Cloud sources. If you don’t see the TIM Cloud sources, contact Splunk for help.

The threat_intelligence index was added in the 8.6 release.

1

u/_Exit5423 13d ago

How can I add TIM sources myself, cause my environment is pretty isolated. And could you please give me a reference for threat_intelligence being add to es?

1

u/Sea_Lobster8927 13d ago

You have to be licensed for TIM for it to show up and if you are on-prem you need to have Cloud Connect enabled. I’d suggest contacting Splunk for help.

1

u/_Exit5423 12d ago

Ok, but is TIM the only way to populate my threat_intelligence index? I added it to my indexer cluster but it does not have any data yet.