DentiSystems Add-on for Splunk

DentiSystems Add-on for Splunk (TA-dentisystems) connects Splunk Enterprise and Splunk Cloud with the DentiSystems active defense and threat intelligence ecosystem. The add-on enables security teams to ingest and analyze high-fidelity telemetry from DentiSystems platforms, including DentiGrid, distributed deception and threat intelligence infrastructure; GATE, edge security gateways; and LEAKS, credential exposure and breach monitoring. DentiSystems focuses on identifying adversary activity through deception-based and intelligence-driven detection. Interactions with DentiSystems deception infrastructure can provide high-confidence indicators of reconnaissance, scanning, exploitation attempts, and credential abuse, helping security teams prioritize activity that warrants investigation. Key Highlights: High-Confidence Threat Intelligence: Ingest adversary IP addresses, attack activity, targeted protocols, indicators, and related telemetry into Splunk for investigation and correlation. DentiGrid Integration: Bring telemetry from distributed deception sensor nodes into your existing Splunk SecOps workflows. GATE & LEAKS Intelligence: Correlate edge security and credential exposure intelligence with broader security data. CIM-Oriented Normalization: Map supported telemetry to relevant Splunk Common Information Model (CIM) data models, including Intrusion Detection, Alerts, and Network Traffic. Flexible Ingestion: Support automated scheduled feed polling through the Python-based modular input, with supported HTTP Event Collector (HEC) workflows where configured in the deployment. Security Operations Integration: Use DentiSystems intelligence alongside existing Splunk searches, dashboards, alerts, and correlation workflows. Enterprise-Ready Architecture: Designed to integrate DentiSystems threat intelligence into existing Splunk-based security operations without requiring a separate analysis platform.