Skip to main content
You can bring SOC Defenders threat indicators into Splunk either by polling the REST API with a scripted input or HTTP Event Collector, or by connecting Splunk Enterprise Security’s Threat Intelligence Management module to the SOC Defenders TAXII 2.1 feed. The REST approach works on any Splunk deployment and is available on the Free tier; TAXII requires Splunk Enterprise Security and a Pro subscription.

​
Option 1: REST API polling

Use a scripted input or the HTTP Event Collector (HEC) to poll GET /api/v1/iocs on a schedule and forward the results to Splunk.

​
Set up the scripted input

1

Generate an API key

In the SOC Defenders dashboard, open the API Keys tab and create a new key. Copy the key value — you will not be able to view it again.
2

Create a polling script

Save the following script on your Splunk heavy forwarder or search head. Replace YOUR_API_KEY and YOUR_HEC_TOKEN with your actual values.
poll-iocs.sh
3

Schedule the input

In Splunk Web, go to Settings → Data inputs → Scripts and add the script. Set the interval to 900 seconds (15 minutes) for Free tier accounts. Pro accounts can reduce the interval to 60 seconds or lower.
Free tier accounts are limited to 100 IOCs per request and 1,000 requests per day. If you need higher throughput or longer lookback periods (up to 365 days), upgrade to Pro.

​
Option 2: TAXII 2.1 (Pro)

Splunk Enterprise Security includes a Threat Intelligence Management module with a built-in TAXII client. You can point it directly at the SOC Defenders TAXII server for automatic, scheduled feed polling.
TAXII 2.1 integration requires a SOC Defenders Pro subscription and Splunk Enterprise Security.

​
Configure the TAXII feed

1

Open Threat Intelligence Management

In Splunk Enterprise Security, go to Security Intelligence → Threat Intelligence Management → Threat Intelligence Sources.
2

Add a new TAXII source

Click New Source and select TAXII Feed. Fill in the following fields:
3

Select collections

After connecting, choose from the available collections:
  • All IOCs — every indicator type
  • IPs only — IPv4 and IPv6 addresses
  • Hashes only — MD5, SHA1, SHA256
  • CVEs — vulnerability identifiers
4

Save and verify

Save the source. Splunk ES will begin polling immediately. You can verify ingestion under Security Intelligence → Threat Intelligence Sources — look for a green status indicator and a non-zero indicator count.

​
Hunting with SPL

Once IOCs are in Splunk, use the following SPL examples to hunt for matches in your environment.

​
Match network traffic against ingested IP indicators

​
Match DNS queries against ingested domain indicators