Splunk Integration - Reyhford Threat Intelligence

Connect Splunk Enterprise Security (ES) to the TAXII 2.1 feed for automated threat intelligence ingestion.

Prerequisites

Splunk ES with Threat Intelligence Management
API key from reyhford.com/portal

Configure TAXII feed

In Splunk ES, go to Configure → Content → Threat Intelligence Management → New Threat Intelligence Collection.
Select TAXII as the source type.
Enter server details:

Field	Value
Server URL	`https://reyhford.com/api/taxii2/`
Collection	`ics-feed`
Username	(leave blank)
Password / API Key	Your API key
Version	TAXII 2.1

Set polling interval to 15–60 minutes.
Enable Use added_after for incremental updates.

Collections

Collection	Content
`global-feed`	All indicators — ICS/OT and IT protocols
`ics-feed`	ICS/OT only — Modbus, S7, BACnet, IEC 104, EtherNet/IP, Guardian AST
`network-feed`	IT protocols — SSH, SMB, HTTP, MySQL

STIX 2.1 objects

Reyhford returns STIX 2.1 indicator objects with:

ipv4-addr — attacking IP
network-traffic — port and protocol
autonomous-system — ASN and organization
location — country
indicator — STIX pattern, MITRE kill chain phase, confidence score
sighting — observation count, first and last seen

Splunk ES maps STIX indicators to notable events based on your correlation searches.

Verification

# Confirm feed connectivity outside Splunk
curl -s "https://reyhford.com/api/taxii2/collections/ics-feed/objects/?limit=1" \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1" | jq '.objects | length'

Troubleshooting

401 Unauthorized

Verify the API key is active and passed as Bearer token. Discovery works without auth; objects require a key.

Empty feed

New sensors take a few minutes to produce enriched indicators. Check status.reyhford.com.

Only seeing SSH/SMB, no ICS protocols

Switch collection from global-feed to ics-feed.

​Prerequisites

​Configure TAXII feed

​Collections

​STIX 2.1 objects

​Verification

​Troubleshooting

​Related