ThreatPipes App for Splunk

Why you should download this app

Discover where your (or someone else's) network can be compromised.

The ultimate offensive and defensive security tool for Splunk.

Download the ThreatPipes App for Splunk on Splunkbase FREE here.

About ThreatPipes

ThreatPipes is a reconnaissance tool that automatically queries 100’s of data sources to gather intelligence on IP addresses, domain names, e-mail addresses, names and more.

You simply specify the target you want to investigate, pick which modules to enable and then ThreatPipes will collect data to build up an understanding of all the entities and how they relate to each other.

DNS, Whois, Web pages, passive DNS, spam blacklists, file meta data, threat intelligence lists as well as services like SHODAN, HaveIBeenPwned? and many others are used to discover intelligence on a target.

By following chains of intelligence, ThreatPipes also uncovers other affiliated targets that have a relationship to your original target. For example, a domain entered in a scan might resolve to SSL certificates, to known malicious domains, to IP addresses, and so on.

The data returned from a ThreatPipes scan will reveal a lot of information about your target, providing insight into possible data leaks, vulnerabilities or other sensitive information that can be leveraged during a penetration test, red team exercise, blue team activities, or for threat intelligence.

Teamed with Splunk, you can explore and examine this intelligence gathered by ThreatPipes in ways never before possible.

Download ThreatPipes FREE here: https://www.threatpipes.com.

Quick start guide

1. Install Splunk App

Install this app on a single Splunk instance in the normal way. It should work on distributed deployments too (but we have not tested setup yet).

2. Select how you want to import data

You have two options for this:

Stream events from ThreatPipes to Splunk (requires ThreatPipes license) [read 2a]
Manually import data from ThreatPipes to Splunk [read 2b]

2a. Stream data from ThreatPipes to Splunk (requires ThreatPipes license)

Setup your ThreatPipes instance to stream to Splunk by specifying your Splunk server under Server Settings in ThreatPipes.

By default the ThreatPipes Splunk app ships with an input listening on tcp:514 disabled by default using sourcetype=threatpipes-syslog. Make sure at least one input is enabled before attempting to stream data.

When starting a scan (that you want the intel to be streamed to Splunk) make sure you have checked the "Log Stream".

2b. Export scan data from ThreatPipes and import to Splunk

Export all or partial results from a scan in .csv format.

You can also export scan data for multiple scans in .csv format using the scan list view.

"Import ThreatPipes data to Splunk")

Import the data to Splunk using your preferred method. Be sure to select sourcetype=threatpipes-csv and index=threatpipes

3. Start Splunking

Intel overview

Start on the Mains dashboard. It will show you an overview of all the intelligence imported from ThreatPipes. Click on any panel to drill down to the Scan Dashboard.

Intel analysis

Take a deeper look at the intelligence generate for potentially risky data that you can use offensively (e.g. network weaknesses) or defensively (e.g threat intelligence).

Cross reference intel

See if any of the intel uncovered by ThreatPipes is seen in the logs stored in you Splunk instance to identify potential threats.

Filter and export

Export the intel as threat lists to use with Splunk Enterprise security (and other tools).

Release Notes

Version 0.1.3

Changelog.

Initial release.

Support

Contact the Threatpipes team here

License

This code is licensed under an MIT license.

Download the source code on Gitlab.

Developer guide

Testing

You can use this test data to populate dashboards for testing, if needed:

Packaging

Using MacOS, create a .tar.gz for Splunkbase:

COPYFILE_DISABLE=1 tar -czv --exclude='.*' -f threatpipes-splunk.tar.gz threatpipes-splunk/