Infoblox’s global team of threat hunters uncovers a DNS operation with the ability to bypass traditional security measures and control the Great Firewall of China. Read about “Muddling Meerkat” and the many other threat actors discovered by Infoblox Threat Intel here.

Best Practices

Splunk application for ActiveTrust Cloud

Posts: 15

Splunk application for ActiveTrust Cloud

Hello,

I have just published a Splunk application for ActiveTrust Cloud.

This application allows to:
- get ActiveTrust Cloud logs into Splunk using the REST API introduced with ATC 2.0
- filter it efficiently with full drill down support based on the time, threat property, threat class, source IP, domain name, query type and much more
- get context from Infoblox Dossier threat intelligence.

Mandatory requires ActiveTrust Cloud.
Optionally requires Dossier for threat intelligence

https://splunkbase.splunk.com/app/3850/

Some screenshots

Any feedback welcome.

Regards

Nicolas