Threat Intelligence Platform Integration

andrewjo · February 26, 2019, 7:39am

Hi Guys,

Any idea , how integrate Threat Intelligence Platform with ELK?
Or I just create some config in logstash and manually lookup csv from TI data source feed?

Thanks.

stiltz · February 27, 2019, 2:43am

It depends on your TIP and how you consume threat intelligence. If you stage CSV files somewhere on a regular basis you could use the Logstash CSV filter plugin.

If you use a commercial TIP it may have an API or database that you could consume with the appropriate Logstash input plugin. This method would probably help with normalization of your intel feed fields since each source/vendor seems to label everything different and your TIP may handle normalizing that for you already.

system · March 27, 2019, 2:43am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Threat Intelligence Elasticsearch	7	1831	January 3, 2018
Matching threat intel to data in ELK Elasticsearch	3	1704	July 6, 2017
Need to integrate threat Intel with ELK, which solution shall i look for, any opensource suggestion? Elasticsearch	1	316	August 2, 2018
Threat Intelligence Integration won't show any data Elastic Security	8	434	October 25, 2023
Threat hunting/cifv4 and logstash http filter Logstash	1	423	June 26, 2019

Threat Intelligence Platform Integration

Related topics