Splunk威胁情报增强
原名：building-threat-intelligence-enrichment-in-splunk
在 Splunk Enterprise Security 中构建自动化 IOC 富化流水线，通过 KV Store 收集威胁情报，利用查找表和威胁情报框架与事件关联，辅助相关搜索标记 IOC 匹配，缩短 SOC 响应时间。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 2
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-25
- TRACE 评分
- 3.8 / 5
内容概览
Splunk's Threat Intelligence Framework in Enterprise Security enables SOC teams to automatically correlate indicators of compromise (IOCs) against security events. The framework ingests threat feeds, normalizes indicators into KV Store collections, and uses lookup-based correlation searches to flag matching events. Splunk Threat Intelligence Management centralizes collection, normalization, and enrichment from multiple sources, reducing triage time by providing analysts with immediate context. - When deploying or configuring building threat intelligence enrichment in splunk capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation - Splunk Enterprise Security (ES) 7.x or later - Threat Intelligence Manag…