# Can I use my own Threat Intel stored in plain txt file using filebeat module? **URL:** \ **Category:** Elastic Security\ **Created:** [October 17, 2021, 6:45am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911 "2021-10-17T06:45:26Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [October 17, 2021, 6:45am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/1 "2021-10-17T06:45:26Z")
Hi, I have elastic SIEM 7.15 and have enabled threat intel filebeat module; it works very well however wondering if I can use my own threat intel gathered and stored in plain txt file? This comprises of IP Addresses, domains, URLs, hashes? Can someone please guide me? TIA Blason R ---
**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\ **Post date:** [October 18, 2021, 6:50am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/2 "2021-10-18T06:50:10Z")
Hi yes, definitly. You will have to setup parsing for it though, either through logstash or through Elasticsearch ingest pipeline. By configuring a file input you can read the txt file in with filebeat. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [October 18, 2021, 9:23am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/3 "2021-10-18T09:23:55Z")
Agree what needs to be done to match the with the traffic? Is there any specific parsing done for inbuilt threat module. ---
**Author:** ![n2x4](https://avatars.discourse-cdn.com/v4/letter/n/3e96dc/32.png) [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Post date:** [October 18, 2021, 12:52pm UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/4 "2021-10-18T12:52:11Z")
I'd recommend reviewing the fields that are added with the threat intel module and adding the fields to your source data as needed. I've done this in my lab as follows - Using the CINSscore threat intel feed, I ingest it through filebeat and use ingest pipelines to add the following fields: ```auto event.module = threatintel threatintel.indicator.provider = cinsscore threatintel.indicator.type = ipv4-addr ``` I then rename the message field which only contains the IP to "threatintel.indicator.ip" I'm also hashing the IP to generate a unique value for the \_id field so I don't get duplicate intel records. This works because the threatintel rules are running the following indicator matches - `(source.ip MATCHES threatintel.indicator.ip) OR (destination.ip MATCHES threatintel.indicator.ip)` and querying the following indicator index- ```auto event.module:threatintel and (threatintel.indicator.ip:*) ``` I haven't looked into adding this into the filebeat module, but I am able to use filebeat to work off of the custom fields and indexes the module uses, so the module SIEM rules work. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [November 9, 2021, 2:49am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/5 "2021-11-09T02:49:17Z")
Hey @n2x4 Would you mind sharing your Threat Intel filebeat config for reference purpose? Wanted to understand how do I match or write parsers to adhere with ECS schema. ---
**Author:** ![n2x4](https://avatars.discourse-cdn.com/v4/letter/n/3e96dc/32.png) [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Post date:** [November 9, 2021, 4:29pm UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/6 "2021-11-09T16:29:46Z")
Here's my config for my custom threat intel source (cinsscore). Just as a reference, this isn't using the ThreatIntel module - just a regular log source with the threat intel fields added and other stuff dropped that I don't need. ```auto - type: log enabled: true paths: - /home/elastic/cinsintel/*.txt fields: threatintel.indicator.type: ipv4-addr service.type: threatintel threatintel.indicator.provider: cinsscore event.module: threatintel fields_under_root: true processors: - rename: fields: - from: "message" to: "threatintel.indicator.ip" - fingerprint: fields: ["threatintel.indicator.ip"] target_field: "@metadata._id" - drop_fields: fields: ["agent.ephemeral_id", "agent.id", "agent.version", "ecs.version", "host.architecture", "host.containerized", "host.hostname", "host.id", "host.ip", "host.mac", "host.name", "host.os.codename", "host.os.family", "host.os.kernel", "host.os.name", "host.os.platform", "host.os.version", "input.type", "log.offset"] ``` ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [November 12, 2021, 3:16am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/7 "2021-11-12T03:16:58Z")
Thanks mate!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 10, 2021, 3:17am UTC](https://discuss.elastic.co/t/can-i-use-my-own-threat-intel-stored-in-plain-txt-file-using-filebeat-module/286911/8 "2021-12-10T03:17:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.