Criminal IP releases Splunk TI Feed app for firewall correlation
Original title: Criminal IP Launches New TI Feed App on Splunkbase for Automated Threat Detection
The Splunkbase app refreshes Criminal IP data every three hours and correlates it with firewall logs every 10 minutes.
AI SPERA launched the Criminal IP TI Feed app for Splunk, available on Splunkbase. It correlates Criminal IP threat intelligence with firewall traffic already in Splunk and labels sessions as completed, unanswered, denied, neutral, or unknown. Critical severity is limited to completed sessions with a malicious IP. A daily search checks the latest intelligence against the previous 30 days of firewall traffic, and the app can send grouped Slack alerts.
- Feed data downloads every three hours; correlation searches run every 10 minutes.
- Results go to a summary index rather than repeated raw-log searches.
- Seven dashboards cover assets, IPs, direction, severity, and feed health.
- Slack alerts are grouped by malicious IP and traffic direction and are throttled.
- Criminal IP says the platform is used in more than 150 countries.
- Vendors
- AI SPERA
From the original article
3 min read at gbhackers.com.webp&w=1280&q=75)
Torrance, USA, November 11th, 2026, CyberNewswire Criminal IP, the AI-powered threat intelligence and attack surface management platform developed by AI SPERA, has launched the Criminal IP TI Feed app for Splunk. Available through Splunkbase, the app automatically correlates Criminal IP threat intelligence with firewall traffic logs collected in Splunk. The integration enables security teams to […]
By CyberNewswire · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.