TISC add-on for Splunk overview

The Threat Intelligence Security Center (TISC) for Splunk app offers integration between TISC and Splunk that enables users to seamlessly import the latest threat intelligence from TISC into Splunk for monitoring and enriching alerts. Users can configure indicator collections, perform searches and utilize dashboards to analyse search matches and indicator collections effectively.

• TISC integration with Splunk
  The integration between the Threat Intelligence Security Center (TISC) and Splunk enables users to filter and pull in relevant threat intelligence observables data into Splunk. Within the Splunk, the users can use this data to generate security alerts.
• Creating users in ServiceNow TISC instance
  You can create users in the ServiceNow TISC instance with any valid user role: sn_sec_tisc.api_obs_read_access.
• Configuring TISC add-on in Splunk
  Follow this below procedure to configure the application.