No Talos Data Enrichment on Splunk Enterprise Security 8.X

Applicability

Description

Talos Data Enrichment in Splunk Enterprise Security provides threat intelligence to enrich findings with context such as threat level, category, and descriptions. When the Talos app shows zero data enrichment, it indicates that the intelligence collection from the Talos adaptive response action may not be properly configured or applied to the findings.

Investigation

- Confirm if the Intelligence Collection from the Talos adaptive response action has been added to the relevant findings.
- Verify that the Talos integration is deployed according to the official configuration guidelines.
- Check the time range filter in Mission Control Investigations to ensure it covers at least the last 7 days. 
- Confirm that the Talos data enrichment is expected to appear in the Intelligence tab of investigations.

Resolution

1. Ensure the Intelligence Collection from the Talos adaptive response action is added to the findings requiring enrichment.
2. Follow the official deployment guide for Cisco Talos Intelligence in Splunk Enterprise Security:  
Deploy Cisco Talos Intelligence for Splunk Enterprise Security

3. To view Talos data enrichment in investigations:  
- Navigate to "Mission Control" in the Splunk environment.  
- Click on "Investigations".  
- Set the time range filter to 7 days or more.  
- Click "Apply" to refresh the view.  
- Select the specific finding to review.  
- Click the blue "View Investigation" button in the upper right corner of the finding details.  
- Click on the "Investigation" tab to see Talos data enrichment.  

4. For additional details on these features, refer to the Splunk Enterprise Security 
Release Notes: 
Splunk Enterprise Security 8.X Release Notes

5. Use the Intelligence tab in investigations to access Cisco Talos premium threat intelligence, which enriches findings with classifications and related threat data for URLs, IP addresses, and domain names. 

Related Links

Deploy Cisco Talos Intelligence for Splunk Enterprise Security