AI SPERA launches Criminal IP threat feed app on Splunkbase
First merged summary.
AI SPERA’s Criminal IP TI Feed app for Splunk is on Splunkbase, correlating threat data with firewall logs and sending grouped Slack alerts.
AI SPERA launched the Criminal IP TI Feed app for Splunk, available on Splunkbase. It correlates Criminal IP threat intelligence with firewall traffic already in Splunk and labels sessions completed, unanswered, denied, neutral, or unknown. Critical severity is limited to completed sessions involving a malicious IP. Feed data downloads every three hours and correlation searches run every 10 minutes, with results stored in a summary index. A daily search checks the latest intelligence against the previous 30 days of firewall traffic, and the app can send throttled Slack alerts grouped by malicious IP and traffic direction.
- Critical severity applies only to completed sessions with a malicious IP.
- A daily search compares latest intelligence with 30 days of firewall traffic.
- Results are written to a summary index instead of repeated raw-log searches.
- Seven dashboards cover assets, IPs, direction, severity, and feed health.
- Slack alerts are grouped by malicious IP and direction and are throttled.
- Criminal IP says the platform is used in more than 150 countries.
What each outlet adds
beyond the shared facts- Cyber Security NewsDetails feed cadence, severity rules, dashboards, and Slack alerting.
- Vendors
- AI SPERA
Coverage
oldest first · one row per article · UTC- · 5h ago
Cyber Security NewsFirst report
Criminal IP releases Splunk TI Feed app for firewall correlation
The Splunkbase app refreshes Criminal IP data every three hours and correlates it with firewall logs every 10 minutes.
- · 5h ago
GBHackers
Criminal IP releases Splunk TI Feed app for firewall correlation
The Splunkbase app refreshes Criminal IP data every three hours and correlates it with firewall logs every 10 minutes.