ThreatStream App for Splunk: Introducing Seamless Integration with Enterprise Security

<p>Splunk continues lead the way with it's powerful big data SIEM capabilities inside their Enterprise Security App.</p><p>Here at Anomali we were especially excited with one initiative the company introduced last year, Adaptive Response. We liked it so much we partnered with Splunk to give security teams a powerful way to integrate Threatstream capabilities within the Enterprise Security workflow using the Adaptive Response framework.</p><h2>An Introduction to Adaptive Response</h2><p style="text-align: center;"><img alt="Adaptive Response" src="https://cdn.filestackcontent.com/Cz906ERVSuLhLKZCeXUA"/></p><p>Splunk's Adaptive Response enables security analysts—from hunters to less skilled security staff—to better handle threats. The Adaptive Response Framework resides within Splunk Enterprise Security (ES) and optimizes threat detection and remediation using workflow-based context. Having spent years working with all layers of security teams, I like to think of Adaptive Response as the “security nerve center” to bridge intelligence from multiple security domains, including threat intelligence.</p><p>One of the key parts of the Adaptive Response framework is the ability for analysts to automate actions or individually review response actions to quickly gather more context and take appropriate actions across their multi-vendor environment. For an increasing number of people this means comparing security data against threat feeds, or threat intelligence sources like ThreatStream.</p><h2>Anomali ThreatStream Splunk App</h2><h3>Introducing Adaptive Response Integration</h3><p>The Anomali ThreatStream Splunk App already provides users the ability to download millions of IOCs directly into Splunk to cross-reference against security data, providing dashboards and alerts for analysis. The app now has support for the Adaptive Response action framework providing seamless integration with Enterprise Security.</p><h3>Familiar workflows</h3><h3><img alt="Splunk Workflows" src="https://cdn.filestackcontent.com/Q6IJS8FPRvBgQdSC9cre"/></h3><p>An analyst will likely start an investigation once a notable event has been triggered in Splunk's Enterprise Security. It is at this point they want to add as much context to a notable event, or security incident, in order to complete their investigation as quickly and accurately as possible. One way to do this is to compare raw events that trigger notable event against the ThreatStream IOC database. For example, an analyst might want to look up the suspicious destination of an event that triggered the notable event in ES, to validate whether it should be of concern.</p><h3>Perform actions inside Enterprise Security</h3><p><img alt="Incident Response" src="https://cdn.filestackcontent.com/RlEpHcWQQuQ9vp9bZMw6"/></p><p>Within the Enterprise Security Incident Review dashboard an analyst can select to run an "Adaptive Response Action", in this case "Analyze with ThreatStream". They can then select as many fields in the raw events they want to analyse against ThreatStream IOCs. When the analyst runs the action a Threat Bulletin will be created within ThreatStream and visible within the ThreatStream platform.</p><h3>Bi-directional sync</h3><p><img alt="Bi-directional Sync" src="https://cdn.filestackcontent.com/I1wjGOUBShaq4rpSY1X6"/></p><p>The Threat Bulletin created will contain all incident data and comments from the notable event in Splunk, including the raw event data that triggered the notable event in the first place. Millions IOCs in the ThreatSream database are automatically matched against the raw data of the notable event stored in the Threat Bulletin to identify matches.</p><p>When matches are found they can be examined and triaged in the ThreatStream user interface. Users can approve malicious indicators and reject those found to be benign. This threat intelligence, including full information about each IOC matched to a notable event can then be pushed back down to your security tools, including back into Splunk using ThreatStream Link, to continue any investigation.</p><h3>tl;dr - Anomali ThreatStream App for Splunk Key features</h3><h3><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/pyPrfJbO5MA" width="560"></iframe></h3><ul><li>Seamless integration with Enterprise Security Incident Review workflow</li><li>Bi-directional flow of threat intelligence data for additional enrichment, correlation and analysis</li><li>Automated IOC matching and customizable alerting against your security data in Splunk</li><li>Dashboards detailing event data associated with IOCs allowing you to pivot on severity, type, classification, time...</li><li>Access to weekly Anomali Threat Intelligence briefings</li></ul><h3><a href="https://splunkbase.splunk.com/app/3443/">Download the app now</a></h3>