AI SPERA launches Criminal IP TI Feed Splunk app to correlate threat intelligence with firewall logs
AI SPERA has released the Criminal IP TI Feed app on Splunkbase, enabling automated correlation of Criminal IP threat intelligence with firewall traffic logs indexed in Splunk. The app classifies observed network sessions (completed, unanswered, denied, neutral, unknown) and constrains severity so only completed sessions with malicious IPs qualify as critical, helping SOCs prioritize alerts. It downloads the Criminal IP TI Feed every three hours, runs correlation searches against firewall traffic every 10 minutes, writes results to a dedicated summary index, and runs a daily retrospective search against the previous 30 days of logs. Seven dashboards and consolidated Slack alerting with asset-level details are provided to surface high-priority detections and reduce alert fatigue.
Detalhes técnicos
- Integration: Criminal IP TI Feed app available on Splunkbase (app page: https://splunkbase.splunk.com/app/9625).
- Feed and correlation cadence: TI feed downloaded every 3 hours; correlation searches run every 10 minutes; a daily retrospective search compares feed data against the previous 30 days of firewall traffic.
- Session classification: network activity is labeled completed, unanswered, denied, neutral, or unknown; severity is determined using observed session outcomes (detections without a completed session cannot exceed the watch tier; completed sessions with malicious IPs can be marked critical).
- Data handling: correlation results are written to a dedicated summary index to support dashboards and alerts without repeatedly scanning raw logs.
- Visibility and alerting: seven dashboards (Overview, Investigate, All Detections, IP Lookup, Trends, Alerts, Health); consolidated Slack alerts grouped by malicious IP and traffic direction, including asset-level details, session counts, timestamps and transferred data, with throttling to reduce noise.
- Purpose: provides automated retrospective detection and context to distinguish routine scanning from established sessions that require investigation.
Linha do tempo
-
AI SPERA launches Criminal IP TI Feed Splunk app to correlate threat intelligence with firewall logs
ler a análise desta fonte ocultar
AI SPERA has released the Criminal IP TI Feed app on Splunkbase, enabling automated correlation of Criminal IP threat intelligence with firewall traffic logs indexed in Splunk. The app classifies observed network sessions (completed, unanswered, denied, neutral, unknown) and constrains severity so only completed sessions with malicious IPs qualify as critical, helping SOCs prioritize alerts. It downloads the Criminal IP TI Feed every three hours, runs correlation searches against firewall traffic every 10 minutes, writes results to a dedicated summary index, and runs a daily retrospective search against the previous 30 days of logs. Seven dashboards and consolidated Slack alerting with asset-level details are provided to surface high-priority detections and reduce alert fatigue.
Technical Details
- Integration: Criminal IP TI Feed app available on Splunkbase (app page: https://splunkbase.splunk.com/app/9625).
- Feed and correlation cadence: TI feed downloaded every 3 hours; correlation searches run every 10 minutes; a daily retrospective search compares feed data against the previous 30 days of firewall traffic.
- Session classification: network activity is labeled completed, unanswered, denied, neutral, or unknown; severity is determined using observed session outcomes (detections without a completed session cannot exceed the watch tier; completed sessions with malicious IPs can be marked critical).
- Data handling: correlation results are written to a dedicated summary index to support dashboards and alerts without repeatedly scanning raw logs.
- Visibility and alerting: seven dashboards (Overview, Investigate, All Detections, IP Lookup, Trends, Alerts, Health); consolidated Slack alerts grouped by malicious IP and traffic direction, including asset-level details, session counts, timestamps and transferred data, with throttling to reduce noise.
- Purpose: provides automated retrospective detection and context to distinguish routine scanning from established sessions that require investigation.