Threatbook-NGTIP

Increasingly, security analysts rely on Splunk as a Security Operations and Decision Center. In the log analysis process, threat intelligence is used as one of the decision factors for alert triage and incident response, so it is necessary to integrate external intelligence. This APP provides Splunk with a solution to connect to external threat intelligence, enabling intelligence queries on logs, enriching context with threat intel, and writing the results to a specified data index to facilitate security analysts’ log search, analysis, and subsequent response actions.