Criminal IP Launches Threat Intelligence App for Splunk
AI SPERA's new Criminal IP TI Feed app for Splunk automatically correlates threat intelligence with firewall logs to identify and prioritize security incidents.
AI SPERA has released a new application, the Criminal IP TI Feed app, designed for Splunk users to enhance their threat detection capabilities. Available on Splunkbase, this tool automatically correlates threat intelligence data from Criminal IP with existing firewall traffic logs within a Splunk environment. The primary goal is to provide security teams with actionable insights, enabling them to quickly determine if their organizational assets have communicated with known malicious IP addresses and, crucially, whether those communication attempts resulted in established sessions.
This integration aims to move beyond simple IP lookups and fraud detection, offering a more contextualized view of threats. Security operations center (SOC) teams often face an overwhelming volume of IP reputation alerts. Without sufficient context, distinguishing between routine network scanning and genuine security threats can be challenging. The Criminal IP TI Feed app addresses this by linking inbound and outbound threat intelligence feeds directly to the firewall traffic already indexed by Splunk. It classifies network activity based on observed session outcomes, such as completed, unanswered, denied, neutral, or unknown connections, and assigns severity levels based on actual firewall activity.
Detections where a session was not completed are categorized as 'watch' tier, while critical detections signify a successful session with a malicious IP. This tiered approach allows security analysts to prioritize incidents that pose the greatest immediate risk to the organization. The app automates the process of downloading Criminal IP TI Feed data every three hours and performs correlation searches against firewall traffic every ten minutes, writing results to a dedicated summary index. This optimized approach ensures that dashboards and alerts function efficiently without needing to repeatedly query large raw log files.
Furthermore, the app includes a daily retrospective search capability. This feature compares the latest Criminal IP threat intelligence against the firewall traffic from the preceding 30 days. This is particularly valuable for identifying historical communications with IP addresses that were not flagged as malicious at the time of the original activity. The application provides seven distinct dashboards: Overview, Investigate, All Detections, IP Lookup, Trends, Alerts, and Health. These dashboards offer comprehensive visibility into affected assets, malicious IP addresses, traffic direction, session status, severity, detection history, and the overall health of the feed collection process.
To further streamline incident response, the app can deliver consolidated Slack alerts. These alerts are grouped by malicious IP address and traffic direction, retaining crucial asset-level details such as session counts, timestamps, and data transferred. To prevent alert fatigue, the system throttles repeated notifications for the same issues. By bridging the gap between external threat intelligence and internal network activity, the Criminal IP TI Feed app equips analysts with the necessary context to identify compromised assets and prioritize critical detections based on observed session behavior.
AI SPERA CEO Byungtak Kang emphasized the value of this integration, stating, "Threat intelligence becomes significantly more actionable when connected to the network activity occurring inside an organization. The Criminal IP TI Feed app for Splunk helps security teams identify affected assets and prioritize incidents based on observed session behavior." Criminal IP, AI SPERA's flagship cyber threat intelligence platform, is utilized in over 150 countries and offers various modules including Criminal IP Search, Criminal IP ASM, Criminal IP FDS, and the newly launched Criminal IP TI Feed. The platform's threat intelligence is also accessible through major cloud and data marketplaces like AWS, Microsoft Azure, and Snowflake.