icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Splunkbase will be undergoing a scheduled migration and will be unavailable on Saturday, Oct 1, 2022, from 11AM to 3PM PDT

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading SA-SPLICE
SHA256 checksum (sa-splice_135.tgz) 57e4d0bf9a345c7612f146be19c7429f9736de9964ae085e10eed3347610672f SHA256 checksum (sa-splice_134.tgz) b45b8d8f17a0234abb51973c27b311790df1b9b633c8152b1b36dc384ae5f8c3 SHA256 checksum (sa-splice_133.tgz) fe82b9c0981a1b9f9208e58ce98453c07946a6c2c58c7ad60b6234fba054f83f SHA256 checksum (sa-splice_132.tgz) 3dee431b3a7e13671f82998bf71ccbf384eeb3eb1bc28ff42da3b6f8e8abd0d1 SHA256 checksum (sa-splice_131.tgz) ff6b87e9022189f8f4f5acd2dd0297e888c6f79c6bea279ab7ceec786a015eb1
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate



This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
SPLICE currently supports STIX 1.1, CybOX 2.1, OpenIOC 1.0 and 1.1 formats and provides a way of consuming IOCs in Splunk to leverage the indicators and provide greater context than common threat feeds. SPLICE can monitor local directories, or mount points, for incoming IOCs as well as TAXII feeds like Soltra Edge to periodically poll IOCs.

SPLICE was developed as a proof of concept and relies on a standalone Mongo DB to store the indicators. While SPLICE remains free to use it will probably no more evolve as Splunk Enterprise Security 3.3 now has the same capabilities and also leverage the usage of the KV Store.

Splunk Enterprise Security: https://splunkbase.splunk.com/app/263/

Please refer to the embedded documentation in the app folder:

Installing SPLICE

SPLICE relies on MongoDB to store the ingested IOCs and the extracted atomic indicators. You will need to setup a MongoDB instance somewhere in your environment in order for SPLICE to work (use the regular MongoDB installation process). Ideally, you would install this MongoDB instance on the Splunk Search Head but you could alternatively install it elsewhere.

Upgrading to v1.3

If you are planning on upgrading from a previous version of SPLICE to the v1.3.x, please read the SPLICE documentation before installation. Among other things, you should disable your currently installed version of SPLICE and also possibly migrate your customizations after you install the new version.

Splunk license impact

SPLICE does not impact your Splunk license:

  • IOCs are stored directly in MongoDB (out of the scope of Splunk licensing)
  • Matching events are stored using the collect command which works only on already indexed data (see Automating IOC searches for details)
  • SPLICE is a free app.

Data Inputs - Mount point monitor

The Modular Input "IOC - Mount point monitor" allows monitoring of directories for incoming IOCs. Those directories can be local directories or mount points with at least read-only permissions. This Modular Input will monitor .ioc and .xml files (case insensitive).

Once a new file is detected, or an existing file has been modified, the file is read and stored in the MongoDB in its original form (collection "raw"). The stored IOC is marked as "to be parsed" in order to extract from it the atomic indicators.

Please note that the name you use for the data input will be the name that is used for the IOC Sources dashboard to compare your different sources of IOCs.

Data Inputs - TAXII Feeds

TAXII defines a set of services and message exchanges that, when implemented, enable sharing of actionable cyber threat information across organization and product/service boundaries. TAXII, through its member specifications, defines concepts, protocols, and message exchanges to exchange cyber threat information for the detection, prevention, and mitigation of cyber threats.

TAXII is the preferred method of exchanging information represented using the Structured Threat Information Expression (STIX) language, enabling organizations to share structured cyber threat information in a secure and automated manner.

SPLICE Form - Indicator Search

The Indicator Search form can be used to search for the existence of indicators within SPLICE. The form is searching for the saved indicators within MongoDB. The search comes in the form of a regular expression along with an option to ignore case. You may click the results to view the IOC in the IOC Viewer form.

SPLICE Form - IOC Viewer

The IOC Viewer allows you to view your stored IOCs. To retrieve an IOC, you may use any of the following fields: IOC ID (ioc_id), Indicator ID (indicator_id), SPLICE Indicator ID (indicator_raw_id) and SPLICE IOC ID (ioc_raw_id). Besides seeing the raw IOC text, you can also view IOC key-value pairs.

SPLICE Commands

SPLICE provides the following set of commands :

  • iocsearch : search IOC atomic indicators across your data.
  • iocstats : used by SPLICE dashboards to extract simple statistics out of the MongoDB.
  • iocfilter : evaluate chosen PCRE/regex across the stored atomic indicators
  • iocexportcsv : export the stored atomic indicators in a CSV file.
  • iocdisplay : retrieve chosen IOCs by their IDs and display them (useful to see the course of actions, the campaign, the actors, etc)


  • SPLICE v1.3.5 - 2015/03/30 - Feature

    • iocfilter command new flag addTime
  • SPLICE v1.3.4 - 2015/02/15 - Fixes

    • Fixed log messages for TAXII inputs to populate IOC Consumption dashboards
    • Explained how to capture problematic IOCs for the StartTag error
  • SPLICE v1.3.3 - 2015/02/10 - Fixes

    • iocdisplay documentation fixes
    • iocdisplay command fixes
  • SPLICE v1.3.2 - 2015/02/04 - Feature Enhancements

    • Improved STIX EmailMessage parser
    • Improved STIX FileObject parser (now support Fuzzy Hashes)
  • SPLICE v1.3.1 - 2015/02/03 - Feature Enhancements

    • Splunk Enterprise Security (ES) Integration
      • App directory name changed from "splice" to "SA-Splice"
      • Two ES Correlation Searches created:
        • Endpoint - Multiple Hosts Related to the Same IOC - Rule
        • Endpoint - Multiple IOCs related to one host - Rule
      • Default Scheduled Searches are now configured to not show as triggered alerts when matches are found (this can be re-enabled manually)
    • The macro iocs_detected_sum_index has been created and utilized through SPLICE to allow users to easily change the summary index for detected iocs
    • Changed the default summary index value for detected iocs to iocs_detected
    • Pre-configured TAXII feeds for hailataxii.com have been added
    • Added relevant CIM-related eventtypes to ioc matches
    • Added relevant CIM-related tags to ioc matches
    • Added IOC full sweep workflow to search for historical hits to detected iocs
    • Fix of time parameters for Top Detected Indicator Types dashboard panel
    • Fix of sort command that sometimes limited total returned ioc matches
    • Added STIX parser for EmailMessageObjectType
    • Fixed a typo in STIX parser for AddressObjectTye
    • Enhanced STIX parser AddressObjectType with e-mail type coverage.
    • Parser for URIObject no more requires the field 'type' and assume 'URL' as default value.
  • SPLICE v1.2.1 - 2014/12/20 - Maintenance release

    • Fix update_taxii_last_timestamp_label() - thanks to CERT Australia for the patch!
  • SPLICE v1.2.0 - 2014/11/17 - Feature Enhancements

    • STIX/CybOX parser externalization
    • New OpenIOC parsing logic (compatible with OpenIOC v1.0 and v1.1)
    • OpenIOC parser externalization
    • Core code reorganization
    • python-libtaxii upgraded to 1.1.104 (was: 1.1.102)
    • python-stix upgraded to (was:
    • python-cybox upgraded (was:
    • Dashboard menus renamed (backend only)
    • Documentation updates
    • Ability to (de)activate atomic indicators
      • iocfilter command new parameter displaydisabled
      • Form Indicator Search new drop-down choice
      • iocsearch command modified to exclude deactivated indicators
      • new command ioctoggle to change the state of indicators
    • TAXII dual authentication support with pem/key cert files
    • [fix] wrong timezone used for the TAXII feeds
    • iocsearch command now supports a generic hash type hash
      • The previous individual scheduled hash searches were replaced with a scheduled universal hash search called ioc_default_search_hash
      • CIM mapping for the ioc_default_search_ipv4-addr and ioc_default_search_ipv6-addr scheduled searches changed from src to src_ip and dest to dest_ip
  • SPLICE v1.1 - 2014/10/08 - Public release

    • bug fixes
    • new features
  • SPLICE v1.0 - 2014/09/01 - Restricted access release

    • intial release

Release Notes

Version 1.3.5
March 31, 2015

Created by Splunk Security Practice

Version 1.3.4
Feb. 13, 2015

Created by Splunk Security Practice

Version 1.3.3
Feb. 10, 2015

Created by Splunk Security Practice

Version 1.3.2
Feb. 4, 2015

Created by Splunk Security Practice

Version 1.3.1
Feb. 3, 2015

Created by Splunk Security Practice

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.