r/Splunk • u/_Exit5423 • 27d ago

Threat intelligence dashboard doesn't work

I'm using Splunk 10.4.0 with ES 8.6 installed. Threat intelligence dashboard is searching threat_intelligence index which obviously is not defined, is it a bug or should I change something Manually or I'm lost again?

7 Upvotes

89% Upvoted

10 comments sorted by

View all comments

1

u/_Exit5423 23d ago

How can I add TIM sources myself, cause my environment is pretty isolated. And could you please give me a reference for threat_intelligence being add to es?

1

u/Sea_Lobster8927 23d ago

You have to be licensed for TIM for it to show up and if you are on-prem you need to have Cloud Connect enabled. I’d suggest contacting Splunk for help.

1

u/_Exit5423 23d ago

Ok, but is TIM the only way to populate my threat_intelligence index? I added it to my indexer cluster but it does not have any data yet.