DV IOC Enrichment

DV IOC Enrichment automates threat intelligence enrichment for Splunk Enterprise Security notable events. The app extracts IP addresses, domains, URLs, and file hashes from configured notable event fields and queries supported intelligence providers, including VirusTotal, AbuseIPDB, MISP, and AlienVault OTX. Provider responses are evaluated against configurable malicious and critical thresholds. Findings can automatically update notable urgency, add enrichment evidence as an ES comment, and trigger email notifications. Priority-based detection policies allow administrators to control which notable events are enriched and which providers, thresholds, urgency levels, and email actions are applied. Policies support exact and pattern matching against detection fields. DV IOC Enrichment reduces the operational overhead of investigating repeated indicators while preventing unnecessary API usage through configurable caching, exclusion rules, provider-specific quota controls, and multi-key rotation. Each provider operates independently. If one provider becomes unavailable or reaches its quota, enrichment continues through the remaining providers. Incomplete events can be managed through the Retry Queue using individual or bulk retry and reset actions. The app includes: - Automatic enrichment of Splunk ES notable events - VirusTotal support for IP, domain, URL, and hash indicators - AbuseIPDB support for public IP reputation - MISP support for IP, domain, URL, and hash attribute matches - AlienVault OTX support for IP, domain, URL, and hash pulse intelligence - Priority-based Detection Policies with exact and pattern matching - Per-detection provider, threshold, urgency, and email controls - Configurable malicious and critical thresholds for each provider - Multiple API keys with quota-aware rotation - Per-provider request and quota controls - Reusable enrichment cache with configurable TTL - Exact, CIDR, IP range, and domain suffix exclusions - Permanent and expiring exclusions - Automatic exclusion synchronization from Splunk lookups - Independent provider fallback and retry handling - Individual and bulk Retry Queue operations - Automatic urgency updates and ES comments - Optional email notifications - Operational dashboard with evidence drilldown and 24-hour metrics - Read-only application Health Check - Structured internal logging