Threat Grid Splunk Add-On:

The Cisco Threat Grid Add-On for Splunk leverages the Threat Grid API to enrich events within Splunk. This occurs by pulling the user's organizational submission data into Splunk making it searchable via timestamps, threat score, user associated with sample submission, and many other options.

Before using you must update the following:

Configuration Guide for Cisco Threat Grid Add-On for Splunk

1. Download Cisco Threat Grid Add-On for Splunk from Splunkbase here: https://splunkbase.splunk.com/app/4251/

2. Login to Splunk Enterprise

3. On the top left of the homescreen click on the "App Settings" button (the gear symbol)

4. On the App Settings page click the "Install app from file" button on the top right

5. On the Upload app page click the "Choose File" button and select the file from the pop-up

6. Click the "Upload" button

7. A restart is required to complete installation. Select "Restart Now" or "Restart Later"

8. After reboot log back into Splunk Enterprise

9. In the Apps bar on the homescreen click on the "Cisco-Threat-Grid" icon

10. On the top left of the Cisco-Threat-Grid screen click on the "Configuration" tab

11. Within the Logging tab, leave the Log level set to "INFO"

12. Click on the "Add-on" Settings tab and enter your Cisco Threat Grid API key and click "Save"

13. Configuration is now complete. Splunk will begin to populate with Cisco Threat Grid organizational information.

Usage: