Accenture CTI IntelGraph Add-on
Overview
Details
The iDefense Intelgraph Add-On allows you to:
- Receive alerts on ACTI indicator matches allowing your SOC to shrink decision time and respond even faster to evolving threats
- Ability to enrich data in Splunk with ACTI Fields to quickly gain context on active threats
- Check the ACTI Integration Health Check dashboard to verify threat indicators are being downloaded regularly
- Use Splunk's Threat Intel Framework to quickly enable out of the box use of high fidelity ACTI data
- Leverage ACTI's non-hierarchical KV store data to develop highly advanced correlation searches for use case development
Installation and Configuration documents can be found here.
Note:
- Patch version 7.3.5 is required for this TA to Work with Splunk Version 7.3
Release Notes
Version 3.3.0
- Added vulnerability intelligence feed and correlation search for vulnerability match.
- Added adaptive response action, allowing to ad hoc query for threat indicators for notable context menu.
Version 3.2.0
- Old indicators that are deemed irrelevant no longer triggers the Threat Match use case.
- Indicators older than 3 years are removed.
- Added support for proxy config.
- Upgraded the TA to fully support ES version 6.3.0 and above.
Version 3.1.0
New content:
3.1
- Added file indicators collection and threat intelligence
- Updated the threat match correlation search for file indicator match
- Branding changed from iDefense to ACTI
3.0
- ACTI Integration Health Check Dashboard.
- Correlation Search that triggers notables for ACTI Threat Match.
- ACTI KV stores to store added ACTI context for indicators.
- Macros for enriching data with ACTI Context
- Updated threat indicator Download Commands.
- Added support for ACTI Plugin for Splunk Mission Control.
Note:
- Patch version 7.3.5 is required for this TA to Work with Splunk Version 7.3
Version 3.0.0
Following New Contents were added:
- ACTI Integration Health Check Dashboard.
- Correlation Search that triggers notables for ACTI Threat Match.
- ACTI KV stores to store added ACTI context for indicators.
- Macros for enriching data with ACTI Context
Updates:
- Updated threat indicator Download Commands.
- Added support for ACTI Plugin for Splunk Mission Control.
Version 2.3.0
This version updates our supported versions of Splunk through 8.1. No other features or fixes are included; however, we are actively developing improvements and will share more information soon.