Configure proxy server settings in Splunk Enterprise Security

When threat intelligence data is ingested, fields are often embedded within each other. By configuring threat list settings you can separate the fields. Extraction of field and their corresponding values is based on when threat documents are processed and written to their respective threat collections. Configure parse modifier settings to extract fields from the threat intelligence data.

Steps

To configure global settings, follow these steps. Be sure to read Important information about global settings after these steps.

1. In Splunk Enterprise Security, select Configure and then Threat intelligence.
2. Select Proxy and parser settings.
3. Optionally, turn on any of the following parse modifier settings:
   • Certificate attribute breakout
   • IDNA encode domains
   • Parse domain from URL
   • Normalize IP
4. Turn on the parse modifier setting based on your requirements. Turn on Certificate attribute breakout to parse fields in the certificate_issuer and the certificate_subject fields.
   For example: A raw certificate issuer field might be a single string as follows:
   C = US, ST = CA, L = San Francisco, O = The Company Name, OU = The Organizational Unit Name, CN = The common name, emailAddress = theemailaddress@email.gov, STREET=123 main street
   Multiple other potential fields may exist within this single string. When you parse fields in the certificate_issuer fields by activating the Certificate attribute breakout parse modifier, all extra fields are parsed from the raw certificate_issuer field and stored into their own fields in the collection as follows:
   • 'certificate_issuer_common_name': 'The common name',
   • 'certificate_issuer_email': 'theemailaddress@email.gov',
   • 'certificate_issuer_locality': 'San Francisco',
   • 'certificate_issuer_organization': 'The Company Name',
   • 'certificate_issuer_state': 'CA',
   • 'certificate_issuer_street': '123 main street',
   • 'certificate_issuer_unit': 'The Organizational Unit Name'
   When you parse fields in the the certificate_subject field fields by activating the Certificate attribute breakout parse modifier, parsing occurs as follows:
   • 'certificate_subject_common_name': 'The common name',
   • 'certificate_subject_email': 'theemailaddress@email.gov',
   • 'certificate_subject_locality': 'San Francisco',
   • 'certificate_subject_organization': 'The Company Name',
   • 'certificate_subject_state': 'CA',
   • 'certificate_subject_street': '123 main street',
   • 'certificate_subject_unit': 'The Organizational Unit Name'

   Use IDNA encode domains if you want to transform the names written in non-ASCII characters to their ASCII-based representation. Turn on IDNA encode domains to include both the IDNA and the international encoding for applicable domains in the domain field.

   Use Parse domain from URL if you want to extract a hostname (the domain field) from a URL (the url field) when adding new sources.

Important information about global settings

The Proxy and parser settings you specify as a global setting here is copied as text into the Advanced edit settings on the Data sources page for each data source. Modifying that text setting creates a local configuration that overrides the global setting described in this article.

• If you do not modify the text, that data source will continue to follow the global setting. (Recommended)

• If you choose to modify that setting, even if you undo your modification, that data source will use that specific, local setting and ignore the global setting.

  To restore the connection with the global setting, follow the appropriate step:

  • For a Splunk-provided data source, contact Splunk Support.

  • For a custom data source, delete the data source and re-create it.