# How to apply Third Party or Custom Threat intel feeds with SIEM App?

**URL:** <https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312>\
**Category:** SIEM\
**Created:** [April 16, 2020, 12:06pm UTC](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312 "2020-04-16T12:06:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [April 16, 2020, 12:06pm UTC](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312/1 "2020-04-16T12:06:57Z")

</div>

Hi Guys,

Can anyone please suggest me the way to apply third party threat intel feed to SIEM App? Has that to be done with logstash translate dictionary feature? but since there are multiple indices involved can someone please guide me?

TIA  
Blason R

---

<div class="post-metadata">

**Author:** ![millap](https://avatars.discourse-cdn.com/v4/letter/m/3ec8ea/32.png) [@millap](https://discuss.elastic.co/u/millap)\
**Post date:** [April 21, 2020, 7:26pm UTC](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312/2 "2020-04-21T19:26:34Z")

</div>

Hiya,

You can do this if the event has already been enriched to include the threat intel feed information when it's written to ES.

We use the SIEM detection rules with something like `_exists_:threat_intel.found_in`, and ensure it covers all of the indexes we're interested in generating a Signal against. Currently, we do this on Logstash (general devices like un-supported NGFW (junos or Symantec)), or Filebeat (Zeek data).

We don't use the dictionary feature, however, but it doesn't matter which mutate feature you use. As long as the threat data is in the individual event, you can generate a Signal against it.

Cheers  
Andy

Andy

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [April 22, 2020, 2:58am UTC](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312/3 "2020-04-22T02:58:32Z")

</div>

Whew..thats too much for me at this moment since I have just started with SIEM app. But thats a great start up though and thanks for it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2020, 3:01am UTC](https://discuss.elastic.co/t/how-to-apply-third-party-or-custom-threat-intel-feeds-with-siem-app/228312/4 "2020-05-20T03:01:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.