[ES] Removing threat intel entry

Applicability

Description

The threat intelligence was added to the local threat intel file under its respective category: 

• Local Certificate Intel
• Local Email Intel
• Local File Intel
• Local HTTP Intel
• Local IP Intel
• Local Domain Intel
• Local Process Intel
• Local Registry Intel
• Local Service Intel
• Local User Intel

Upon further review, the added threat intelligence was identified as a false positive, and it is necessary to remove it to prevent Enterprise Security (ES) from conducting threat matching with the false positive data.

Investigation

1. Identify the type of threat intel (Certificate, Email, Filename, Hashes, URLs, IP, Domains, Processes, Registry, Services, Users).
2. Locate the local threat file that the threat intel was added into via Lookup Editor app.
3. Locate the kvstore that will threat intelligence will be added into:

   • Local Intel file name	Intel KVstore name
     Local Certificate Intel	certificate_intel
     Local Email Intel	email_intel
     Local File Intel	file_intel
     Local HTTP Intel	http_intel
     Local IP Intel	ip_intel
     Local Domain Intel	ip_intel
     Local Process Intel	process_intel
     Local Registry Intel	registry_intel
     Local Service Intel	service_intel
     Local User Intel	user_intel

Resolution

1. Once identified where the false positive data resides in, proceed with removal.
2. Remove the entry row from the identified local threat file via Lookup Editor app.
   • This has to be done first to prevent ES from adding false positive data back into the kvstore.
3. Remove the entry row from the identified intel kvstore via Lookup Editor app.
4. Run a simple SPL to verify that modification to kvstore is saved:

   • • | inputlookup <kvstore intel file>
       | search <field>="<false positive entry value>"
       

   • For example:

     • | inputlookup ip_intel
       | search domain="*google.com*"

   • If entry has been successfully removed from intel kvstore, SPL should return 0 result.

Related Links

Supported types of threat intelligence in Splunk Enterprise Security