Note: This Add-on does not work on a Cluster Environment. It only works on Splunk Enterprise and a single instance of Splunk Cloud. Am working to fix the issue related to it not working on a Cluster environment. This Add-on collects IPs, URLs and Domains from well known Open-source websites that can be used by Threat Intelligence analysts or Cyber Security Centres for better correlations of their use cases or searches. It is needed by any security team that do not use MISP and need to retrieve open source IPs, URLs and Domains. The Add-on downloads IPs, Domains, URLs and Phishing Domains from Proof Point IP blocklist, Abuse CNC blocklist, URLHAUS, OpenPhish, DigitalSide Threat-Intel repo FQDN domains, Mitchell Krogza Github phishing domain lists and Romain Marcoux Github phishing domain lists.. All these lists are cleaned and placed into a CSV file that can be used for correlation after the user has created a new input after the installation.
(0)
Categories
Created By
Type
Downloads
Licensing
Splunk Answers
Resources