Skip to content

Commit

Permalink
Update splunk.md
Browse files Browse the repository at this point in the history
  • Loading branch information
ka0ula authored Feb 22, 2024
1 parent 6dba6e0 commit 0c6e903
Showing 1 changed file with 14 additions and 14 deletions.
28 changes: 14 additions & 14 deletions _shared_content/intelligence_center/integrations/splunk.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ Sekoia is providing an application for Splunk to detect threats in your logs bas

## 1. Connect to Splunk Enterprise

1. In a Web browser, type the following and replace `server_ip` and `port` by their values:
1. In a Web browser, type the following and replace `server_ip` and `port` by their values:
http://server_ip:port

!!!note
For Cloud version, only the next step is required
!!!note
For Cloud version, only the next step is required

2. Enter your login and password of your Splunk Enterprise instance
![Splunk-Login](/assets/intelligence_center/Splunk/Splunk-Login.png){: style="width: 60%; max-width: 60%"}
Expand Down Expand Up @@ -45,14 +45,14 @@ _Please find below the explanation of the fields to be configured_
- `Feed ID`: default feed is used by default. For custom feed, add the feed ID. Please find [more information on this documentation](https://docs.sekoia.io/cti/features/consume/feeds/#feeds-listing)
- `Proxy URL` - Here are 2 ways to configure a proxy:
1. If you need the Sekoia application for Splunk to connect directly through a proxy, this field needs to be filled on the installation page (To connect, in a Web browser, type and replace `username`, `password`,`host` and `port` by their values: http://[username:password@]host:port)
2. If you don't want to distinguish the Sekoia application for Splunk network configuration from the configuration of your Splunk instance. The Sekoia application for Splunk takes into account the global Splunk proxy configuration provided by means of the `HTTP_PROXY` and `HTTPS_PROXY` environment variables.
2. If you don't want to distinguish the Sekoia application for Splunk network configuration from the configuration of your Splunk instance, the Sekoia application for Splunk takes into account the global Splunk proxy configuration provided by means of the `HTTP_PROXY` and `HTTPS_PROXY` environment variables.

!!! note
After the launch of Sekoia application for Splunk, Only valid IOCs of [these types](#sourcetype) will be downloaded and updated on Splunk from current date.
After the launch of Sekoia application for Splunk, only valid IOCs of [these types](#sourcetype) will be downloaded and updated on Splunk from current date.

## 3. Sekoia intelligence in Splunk
## 3. Sekoia Intelligence in Splunk

In the following section, here are the Sekoia IOCs type available in Splunk: <a name="sourcetype"></a>
In the following section, here are the Sekoia IOC types available in Splunk: <a name="sourcetype"></a>

|IOC type|Meaning|
|--|--|
Expand All @@ -68,9 +68,9 @@ An IOC is an observable that represents a malicious activity. For more informati
!!! note
Only these Sekoia Indicator types will be updated.

Update is scheduled every night to ensure that valid IOCs are used to detect threats.
Update is **scheduled every night** to ensure that valid IOCs are used to detect threats.

## 4. Search Sekoia intelligence and match with IOCs in Splunk
## 4. Search Sekoia Intelligence and match with IOCs in Splunk

### Search existing Sekoia IOCs in Splunk with expiry date

Expand Down Expand Up @@ -109,14 +109,14 @@ Search in the Internal logs for errors. Please consult [Splunk documentation](ht

- **Sekoia.io App for Splunk**

https://github.com/SEKOIA-IO/SEKOIA.IO-for-Splunk
[https://github.com/SEKOIA-IO/SEKOIA.IO-for-Splunk](https://github.com/SEKOIA-IO/SEKOIA.IO-for-Splunk)

- **Splunk official documentation**

https://splunkbase.splunk.com/app/6327
[https://splunkbase.splunk.com/app/6327](https://splunkbase.splunk.com/app/6327)

https://community.splunk.com/t5/Installation/bd-p/installation
[https://community.splunk.com/t5/Installation/bd-p/installation](https://community.splunk.com/t5/Installation/bd-p/installation)

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/SearchTutorial/InstallSplunk
[https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/SearchTutorial/InstallSplunk](https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/SearchTutorial/InstallSplunk)

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/SearchTutorial/NavigatingSplunk
[https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/SearchTutorial/NavigatingSplunk](https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/SearchTutorial/NavigatingSplunk)

0 comments on commit 0c6e903

Please sign in to comment.