IntSights Application for Splunk
Overview
Details
The IntSights App arms Splunk users with curated external threat intelligence as they detect, prioritize, and respond to security incidents with ease and confidence. Leveraging bidirectional data, SOC analysts perform real-time deep threat correlation and analysis—all from within familiar tools and workflows.
Key Features
- Bidirectional integration with IntSights TIP, Threat Command, and Vulnerability Risk Analyzer
- Enriched IOCs, tailored alerts, and prioritized CVEs seamlessly synchronized with your Splunk data
-Easy pivoting between IntSights and Splunk for threat identification, investigation, and response
Visibility into attacks in progress on your network
DETAILS
For additional information on how to setup your application, please contact sales@intsights.com
For any support issue, please contact support@intsights.com
For additional information, view the solution brief: https://intsights.com/resources/intsights-splunk
For additional information on how to setup your application, please contact sales@intsights.com
For any support issue, please contact support@intsights.com
For additional information, view the solution brief: https://wow.intsights.com/rs/071-ZWD-900/images/IntSights%20%2B%20Splunk%20Solution%20Brief.pdf
Release Notes
Version 1.3.0
- Support in Splunk ES
- Splunk version 8.2 support
- New macro for creating alerts within Splunk on newly added Threat Command alerts
- New macro for creating alerts within Splunk for correlated vulnerabilities
Version 1.2.0
- Added support for ETP Suite Alerts
- Added support for ETP Suite Vulnerabilities and CVEs correlation.
- Added macro to disable outgoing tags and comments for correlated IOCs.
Version 1.1.0
- Filters were added to the Correlation Overview and Correlation Details dashboards
- The Correlation Details dashboard shows many more details, and enables simple viewing of IOCs in the ETP Suite IOCs page
- Enhanced custom alert options
- Support for Splunk v8.1.x
- Bug fixes
Version 1.0.2
Correlation details, clicking on of the indicators will set the default time range based on the query.
Bug fix for connecting the app via proxy.
Version 1.0.1
Improved dashboard panels loading time for fast loading, by caching values from last successful run.
Improved correlation searches, to handle larger data sets.
Retiring IOCs from Master lookup and matched lookup based on IOC retirement policy.
Version 1.0.0
This version is the primary IntSights application for Splunk, other applications will no longer be developed and will be deprecated over time.