IntSights Application for Splunk
Overview
Details
The IntSights App arms Splunk users with curated external threat intelligence as they detect, prioritize, and respond to security incidents with ease and confidence. Leveraging bi-directional data enrichment, SOC analysts perform real-time deep threat correlation and analysis—all from within familiar tools and workflows.
Moreover, the app boasts a built-in Splunk Adaptive Response framework support, delivering automated actions in response to IntSights proprietary threat and alerting data—all to reduce SOC investigation times and enable a rapid, decisive response.
Key Features
Bi-directional integration with IntSights TIP
Automatic threat intelligence data export including IOCs from multiple sources (open source, commercial and from IntSights internal sources)
Automatic alerting on indicators that are active in the environment
Dashboards detailing event data associated with the IOCs found on your environment
Real-Time indicator investigation with IntSights Investigation API - directly from within the Splunk app
Seamless integration with IntSights iInvestigation module for advanced investigation
For additional information on how to setup your application, please contact sales@intsights.com
For any support issue, please contact support@intsights.com
For additional information, view the solution brief: https://wow.intsights.com/rs/071-ZWD-900/images/IntSights%20%2B%20Splunk%20Solution%20Brief.pdf
Release Notes
Version 1.2.0
- Added support for ETP Suite Alerts
- Added support for ETP Suite Vulnerabilities and CVEs correlation.
- Added macro to disable outgoing tags and comments for correlated IOCs.
Version 1.1.0
- Filters were added to the Correlation Overview and Correlation Details dashboards
- The Correlation Details dashboard shows many more details, and enables simple viewing of IOCs in the ETP Suite IOCs page
- Enhanced custom alert options
- Support for Splunk v8.1.x
- Bug fixes
Version 1.0.2
Correlation details, clicking on of the indicators will set the default time range based on the query.
Bug fix for connecting the app via proxy.
Version 1.0.1
Improved dashboard panels loading time for fast loading, by caching values from last successful run.
Improved correlation searches, to handle larger data sets.
Retiring IOCs from Master lookup and matched lookup based on IOC retirement policy.
Version 1.0.0
This version is the primary IntSights application for Splunk, other applications will no longer be developed and will be deprecated over time.