icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Anomali ThreatStream Community App
SHA256 checksum (anomali-threatstream-community-app_503.tgz) 402441c9e5bbd96be5597edcfa63a8cedd829b81f0a0018331e9bbf1e3954515 SHA256 checksum (anomali-threatstream-community-app_502.tgz) fdcd84af59ab1ed77ca97b792f92a10457e174d93b9e880ad69dd69c927a1d75 SHA256 checksum (anomali-threatstream-community-app_501.tgz) 4e53dea113464e21efde76011471fad9ce898e4c357e7f39aa3ee5a474f422f3 SHA256 checksum (anomali-threatstream-community-app_3312.tgz) f829002c7eb1e79ff8f4d269853d390280e072dec06a614a6bfae3b639550e28 SHA256 checksum (anomali-threatstream-community-app_3310.tgz) c6b2fb560d0428428ad39d23f323c7950ac2509b20651e9493a3a81195b5a087 SHA256 checksum (anomali-threatstream-community-app_339.tgz) 8aec6fe8a84bc87836c765d5848a4108e917069830ad85fc832e5ff80204734b SHA256 checksum (anomali-threatstream-community-app_338.tgz) fdc4a07ca9b358636ee62183d6661920e5e450825ed38fc5dd376a824f636650 SHA256 checksum (anomali-threatstream-community-app_337.tgz) 83a9ef290952ab4b9a9448eb06d12e572206a556685c455b52d0f17342565914 SHA256 checksum (anomali-threatstream-community-app_336.tgz) 196bd2277f8e611318c58f7a57eb692a32e4a710bf6e30e8c492a0950336e0f2 SHA256 checksum (anomali-threatstream-community-app_335.tgz) 604e98fc8ed2c48b03bd4520e5a51239eb3f2861f979b3ce39b4e9266a2e2045 SHA256 checksum (anomali-threatstream-community-app_334.tgz) cdf91ffb411a11d1f9b6e8c4c2826876e8f28e3f2a1392038b4add646ecbf843 SHA256 checksum (anomali-threatstream-community-app_333.tgz) e55a924167692eeb3054f1a5b5cea2849dc1c65c048009b9dbad762230c0db86 SHA256 checksum (anomali-threatstream-community-app_332.tgz) 104aac98eb86b247ab611cf9f01afb4ee4c2de7be2d188a68ca86d3ded0d91a4 SHA256 checksum (anomali-threatstream-community-app_331.tgz) 1c1c28919acef97099441b635a066c47af79c65c1d5371f06edd3d2675bd3ba5
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Anomali ThreatStream Community App

Splunk Cloud
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
The Anomali Community App for Splunk combines the quality of Anomali’s threat intelligence with the depth of Splunk’s analytics to help organizations identify and respond to external security threats. The application provides subscribers with the capability to instantly check their exposure against published threats and to automate a health check against subscribers’ own live Splunk event data. Once threat matches are identified, Anomali provides security teams with the tools needed to research and investigate IOCs further.

The Anomali Community App for Splunk provides the following functionality:

  • Download and view Weekly Threat Briefings and Breaking News reports, published by Anomali Labs.

  • Scan logs against Anomali content to identify threats in your environment.

  • Optionally upload log summaries to cloud scanning against millions of Indicators of Compromise.

  • Investigate and Respond to threats identified within your environment.





Quick Start Guide:


System Requirements:

  • Splunk version 6.4, 6.3
  • Linux (x64) or Windows (x64 or x86)


We value your feedback and will continue to update this app on a regular basis. Please send comments, requests, or feedback to splunk@threatstream.com.

Release Notes

Version 5.0.3
March 28, 2017
  • User Experience improvements
  • Bug Fixes
Version 5.0.2
Nov. 29, 2016

Addressed feedback from Splunk certification team

Version 5.0.1
Oct. 3, 2016

Bug Fixes

Version 3.3.12
June 23, 2016

Updated the product logos

Version 3.3.10
May 2, 2016
Version 3.3.9
April 28, 2016
Version 3.3.8
April 19, 2016
Version 3.3.7
March 22, 2016
Version 3.3.6
Jan. 13, 2016

Fixes for the Default Dashboard

Version 3.3.5
Dec. 23, 2015
Version 3.3.4
Dec. 21, 2015
Version 3.3.3
Dec. 19, 2014

Added new Dashboards
UI improvements.

Version 3.3.2
Aug. 21, 2014

Fixes an issue with indexers receiving unnecessary files.

Note, Current ThreatStream customers will need to install the latest version of Optic Link (4.9.8). Please see the Optic.threatstream.com in the Docs section to download this splunk version.

Version 3.3.1
May 29, 2014

5/2014 - version 3.3.1

  • App now compatible with Splunk Enterprise 6.1

5/2014 - version 3.2.0

  • Additional Fields added to Data Model.
  • Additional columns added to Indicator screen
  • Additional drop downs added to Indicator screen
    ** Note: This app is not compatible with Splunk Enterprise 6.1

5/2014 - version 3.1.3

  • Additional Fields added to Data Model.
  • Additional View added to provide insight into web/proxy actions.

5/2014 - version 3.0.2

  • Backend lookup process refined to pave the way toward a Splunk Enterprise Security Add-on.
  • Data Model Acceleration introduced to provide a big performance boost.
  • Multiple dashboards added, including native splunk Maps

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.