Flare Splunk App

Flare integrates Splunk with Flare's Threat Intelligence platform to collect cyber threat intelligence events via API. The app ingests ransom leaks, stealer logs, compromised credentials, lookalike domains, and dark web activity, enabling security teams to monitor external threats targeting their organization. Events are normalized to the Common Information Model (CIM) and mapped to the Alerts, Malware, Network Resolution (DNS), and Threat Intelligence data models. The app includes dashboards for threat visualization, saved searches for reporting on leaked credentials and severity distributions, and configuration options for filtering events by tenant, severity, and source type. Security operations teams can use Flare to assess risk posture, track credential exposure, and respond to emerging threats discovered through dark web monitoring and external attack surface analysis.