splunk
SOCRadar TAXII 2.1
Splunk Cloud
Overview
The SOCRadar TAXII 2.1 Add-on enables Splunk users to collect threat intelligence feeds from SOCRadar's TAXII 2.1 server. It automates the ingestion of indicators such as malicious IPs, domains, URLs, and file hashes into Splunk for security monitoring and threat hunting. The add-on supports multiple collection feeds, incremental data updates, and includes a dashboard for threat visibility.
Release Notes
Version 1.3.0
June 9, 2025
Version 1.1.0 introduces the SOCRadar TAXII 2.1 add-on for Splunk. This add-on collects threat intelligence data from SOCRadar's TAXII 2.1 server. Configure your TAXII credentials globally and set API root and collection IDs for each input. The add-on includes a dashboard to visualize collected threat indicators and supports incremental data collection with checkpoint tracking.