This app integrates OTX indicators collected by TA-otx into the Splunk Enterprise Security threat intelligence framework.
It does this with a series of saved searches running (by default) every 12 hours. Previous versions of this app used a modular input to do this: this input is no longer required and should be disabled if you still have it in your system.
To set up this app after install:
1. Ensure that you have OTX data collected by TA-otx and it is fully backfilled to where you want it
1. Customise the macro otx_index to point to where your OTX data is
1. (Optional) Customise the otx_lookback macro if you wish more/less than 90 days of indicators included
1. (Optional) Customise the schedule of all saved searches if you wish more frequent updates
Currently evaluated indicator types from OTX are:
These map to the equivalent threat intel groups and fields in Splunk ES.
Other field mappings that are important:
threat_categorythreat_groupdescription in the Splunk threat_group_intel collection is composed of both the pulse name and description from OTXsource_path is the URL to view the pulse in detail in OTXThere are a set of disabled saved searches called OTX <intel collection> - Retention included. When enabled, these will run overnight and remove any indicator older than 365 days. The exact length of retention can be tuned by modifying the otx_threat_expiry macro.
Rewrote some searches in order to better integrate with other threat intel sources
Fixed typo in a saved search.
Rewrite for Splunk 8.x and Splunk Cloud.
Initial release
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.