Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Obelisk Threat Intel
SHA256 checksum (obelisk-threat-intel_342.tgz) 1e129492872c0c2adbe0e940864590041d03add83beab0d23d1acaa599a95b29
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Obelisk Threat Intel

Splunk AppInspect Passed
Overview
Details
Overview: Obelisk Threat Intel (formerly Optiv) is a Splunk App that automatically correlates your data with several popular open threat lists. After a few mouse clicks we can start hunting for log sources that are reaching out to, or being attacked from, known attackers. The app can provide increased visibility to potentially malicious activity going on in the organization.

Features:
* Threat list visualization that shows where most of the attackers are located on a globe.
* Easily choose indexes, sourcetypes, or hosts for log entries that match threat list destination IPs, URLs and domains.
* Email alerting feature to notify you of a threat list match that is correlated against your organization's machine data.
* IP search feature that displays threat list activity.
* Domain search feature that displays threat list activity.
* RSS feed which will poll several information security news sites and consolidate the stories on one page.
* Updated information is pulled down from the web 4 times per day.

Obelisk Threat Intel

Obelisk:

Obelisk Threat Intel (formerly Optiv) is a Splunk App that automatically correlates your data with several popular open threat lists. After a few mouse clicks we can start hunting for log sources that are reaching out to, or being attacked from, known attackers. The app can provide increased visibility to potentially malicious activity going on in the organization.

Features:

  • Threat list visualization that shows where most of the attackers are located on a globe.
  • Easily choose indexes, sourcetypes, or hosts for log entries that match threat list destination IPs, URLs and domains.
  • Email Alerting feature
  • IP search feature that displays threat list activity.
  • Domain search feature that displays threat list activity.
  • RSS feed which will poll several information security news sites and consolidate the stories on one page.
  • Updated information is pulled down from the web every 8 hours.

Prerequisites:

  • Splunk 6.3.x and above
  • Linux or Windows Operating System
  • If there is a distributed environment, install the app on the search tier only.
  • Web access is required to several threat lists and news RSS sites.

Install matrix:

Splunk role: App to install
Indexer: none*
Search head: obelisk-threat-intel
Heavy forwarder: TA_obelisk-threat

*create an "obelisk" index on each indexer

Install:

  • Login to Splunk as an admin.
  • Go to Apps->Manage apps
  • Click Install app from file.
  • Browse to the file folder with the app .tar.gz file.
  • Choose the file and click OK.
  • After the app is uploaded and installed, restart Splunk.
  • Please allow up to 9 hours for the main dashboard to populate due to summary indexing.

Upgrade instructions:

  • Stop Splunk
  • Remove the app from the directory structure on Linux:
    rm –rf /opt/splunk/etc/apps/obelisk-threat-intel
    rm -rf /opt/splunk/etc/apps/TA_obelisk-threat
    or on Windows:
    c:\Program Files\Splunk\etc\apps\obelisk-threat-intel
  • Start Splunk
  • Install using the steps shown in the Install section.
  • After the app is uploaded and installed, restart Splunk.
  • Please allow up to 9 hours for the main dashboard to populate due to summary indexing.

Support:

Support is provided as a best effort basis. For best results, post on Splunk Answers. This is an open source app, and the code is posted on GitHub here: https://github.com/ransomvik/optiv_threat_intel

License:

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. See http://www.gnu.org/licenses/

Release Notes

Version 3.4.2
Oct. 20, 2018

*Re-branded app (no longer Optiv Threat Intel)
*Added a new panel that shows which threat lists are being tracked
*Uses the CIM for Network Traffic on the splash screen
*Improved troubleshooting screen
*Certified for Splunk version 7.2

66
Installs
108
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2018 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.