Getting threat intelligence into your existing security products - SIEMs, endpoints, network tools -- can significantly enhance their effectiveness and longevity. Here at Anomali we understand the value of product integrations, so much so that my entire job is to manage the 30+ we currently offer.
Recently we launched a feature that allows you to create your own threat intelligence feeds in CSV, JSON and STIX format for consumption by other products. They're super simple to setup...
Use ThreatStream's search functionality to define the type of indicators you want to include in your feed. I used the search:
(itype="mal_domain") and (status="active") and (confidence>=95)
Translated into English; only include malware domain indicators type that are currently reported as active with a very high confidence score of 95 assigned by ThreatStream.
Once the constraints meet the requirements for your feed, select "save as" to convert it into a saved search you can use across ThreatStream.
In ThreatStream navigate to: Settings > Integrations > New Integration
The pop-up modal will allow you to configure the settings for your feed including:
Once you hit save, ThreatStream will create a custom URL for your feed.
You can now use the URL generated in step two as a feed source to any products that can ingest threat feeds in the configured format.
The feed is updated on a set schedule (every 4 hours in the example above). If you're asked for a polling interval make sure to set it equal to this schedule so you're not making more requests than necessary.
Here's an example using Splunk's Enterprise Security Threat Intel Download input. In the screenshot above, I've created an input for my ThreatStream CSV threat feed. Once active, the indicators will be consumed by Splunk ES and used for log enrichment within the app.
Trying to do integrate with a product that's a little more niche? Let us know on the Anomali forum.
David is a Product Manager at Anomali. He's responsible for developing and executing strategy for integrations to and from the ThreatStream platform, working closely with Anomali customers to help them realize the value that threat intelligence can deliver to their business.