icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Blueliv
SHA256 checksum (blueliv_213.tgz) 5ff3db63253499a462f647e950ce26819409d43fa5dabdb92ef8d44eb921e220 SHA256 checksum (blueliv_212.tgz) b7f3c6c98e632efcdbd00a27c7238c075038397816bba425b56253a9a7499943 SHA256 checksum (blueliv_211.tgz) 14ea202107947555462ee8f25e4f92162c53edf4da904015bcc100eecd6a57c1 SHA256 checksum (blueliv_210.tgz) ae9de382251a964c6c9e6b8dce2b4cf757632e17ad3c3e72a79c16688e688ba1 SHA256 checksum (blueliv_202.tgz) 203b9ef8488ee03ed81d050177d17f40b15bd9b1fe225e0f3819a54cc4210d0f SHA256 checksum (blueliv_201.tgz) 07c0170039c0e3232e6d3fde8f6fed8d708ffdb388016c915b81885454053d35 SHA256 checksum (blueliv_200.tgz) a5f19ecbe049ccf4850d6b84b3b105abc1727d6c05a67d8490ea2921ccf0158a SHA256 checksum (blueliv_105.tgz) bed34bd6c76a4bf2c154978e0a91f36eb569e41f9ab8003292e1f7ef3027d2e9
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate



This app is NOT supported by Splunk. Please read about what that means for you here.
Splunk App for Blueliv automatically integrates Blueliv's Cyber Threat Intelligence into Splunk.

The use of this app will add Cyber Threat Intelligence to your existing data, addressing a comprehensive range of cyber threats including compromised URLs, domains, IPs, etc. to turn global threat data into predictive, actionable intelligence specifically for your enterprise and the unique threats it faces.
Our powerful networks of specialized search engines constantly scour the web for up-to-the-minute data and delivers real-time actionable information

Unsurpassed cyber threat intelligence, now at your disposal.


This app has been tested on a 6.2.2 version of Splunk® installed on a 64 bits Windows
7 Professional and a Debian 7.

Threat Overview:

This dashboard shows you an overview based on the current data in the local Data Base
providing geolocation information as well as the current top 10 affected ASN’s and Domains
giving you the last trends in Cybercrime.

By default once you open the Threat Overview page, data from the last month is shown on
the dashboard. However, you can set up your custom date range using the date picker

This feed provide multiple lookup tables like malicious ips, urls, domains, etc.

Bot Ips:

This tap shows the current state of the Bot Ips feed. It provides information about the last inserted infected ips, as well as trends like most infected operating systems or the top 10 portal domains that bots are reporting data to a C&C.

This feed provide multiple lookup tables like infected ips, operating systems, C&Cs, etc.

Attacking Ips:

Attacking IPs dashboard shows the current state of your Splunk attacking IPs lookup tables. This feed allows you to monitor current threats in real-time and includes geolocation information about the attack, accurate timestamp data and attack categorization. Note this feature is only available to commercial users.


The malware dashboard shows the current state of your Splunk malware hashed lookup tables. This provides a list of most recently analyzed malware samples where you can search for the file hash. This data is rated with confidence levels from LOW to HIGH and search queries can be filtered using this criteria. Note this feature is only available to commercial users.


In this last tap, hacktivism trends are previewed. The top plot is a HeatMap that shows the
countries where a high level of hacktivism has been detected. The bottom plot gives
information about the TOP 6 hacktivism hashtags over the last month.


On this view a threat analyst can create custom searches with multiple IOC inputs such as IP,
Domain, as well as a filtering by a date range.

Clicking on a result will open a new page and you will be able to adapt your search using
Splunk's search engine to create a new custom dashboard or alerts.


If you are interested in getting full access to our Threat Intelligence feed, contact us at
sales@blueliv.com to get your API credentials that will allow you to update Splunk App for
Blueliv’s local Data Base with current and real-time Threat Intelligence updates.

Once you have got your API open Configuration tab and set your api-key and access type (FREE/COMMERCIAL).

Release Notes

Version 2.1.3
May 6, 2020
Version 2.1.2
April 17, 2020
Version 2.1.1
March 10, 2017

Fix hacktivism map

Version 2.1.0
Feb. 14, 2017

Added integrations with Attacking IPs and Malware Hashes

Version 2.0.2
Aug. 5, 2015

Add headers to the requests

Version 2.0.1
April 14, 2015

App icon updated

Version 2.0.0
April 13, 2015
  • Use KV Store to store crimeservers collection anf botips collection
  • Add botips lookup table
  • Add crimeservers/malicious urls lookup table
  • Add dashboard to show botips feed data
Version 1.0.5
March 6, 2015

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.