Criminal IP Unveils TI Feed App on Splunkbase

Criminal IP, an advanced threat intelligence platform powered by AI SPERA, has introduced its latest application, the Criminal IP TI Feed, now available on Splunkbase. This innovative tool automatically integrates Criminal IP threat insights with firewall logs within Splunk, offering security teams enhanced capabilities in identifying interactions with malicious IP addresses.

Enhancing Threat Intelligence Integration

The integration of Criminal IP’s TI Feed app with Splunk facilitates the analysis of firewall traffic, enabling security teams to ascertain whether their assets have communicated with known malicious IPs. This development extends Criminal IP’s existing functionalities within the Splunk ecosystem, moving beyond individual IP lookups and fraud detection, and optimizing threat prioritization within current security operations.

Improved Context for IP Reputation Alerts

Security operations often grapple with extensive IP reputation alerts that lack sufficient context, complicating the differentiation between routine scans and critical threats. The Criminal IP TI Feed app addresses this issue by correlating threat intelligence data with firewall traffic indexed in Splunk. It classifies network activity based on session outcomes, including completed, unanswered, denied, and unknown connections, allowing for more precise threat assessment.

Automated Analysis and Retrospective Detection

The app conducts regular data downloads and correlation searches, storing results in a summary index for efficient dashboard and alert operations. A daily retrospective analysis compares current threat intelligence against historical firewall data, identifying past interactions with now-flagged IPs. The app offers seven comprehensive dashboards and Slack alerts, consolidating information by malicious IPs and traffic direction to streamline alert management.

By aligning external threat intelligence with actual network activities, the Criminal IP TI Feed app provides critical context for security analysts, simplifying the identification of assets linked to malicious infrastructures. This automation of data collection and analysis significantly reduces manual workload, allowing SOC teams to respond more effectively to pressing cyber threats.

AI SPERA’s CEO, Byungtak Kang, highlights the value of actionable threat intelligence when integrated with organizational network activity. The Criminal IP TI Feed app on Splunk helps prioritize incidents based on session behavior, enhancing the efficiency of security operations.

Criminal IP remains a key player in global cybersecurity, with its platform used in over 150 countries and integrated with major cloud services. For more information and to download the app, visit Splunkbase.