> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk Integration

> Ingest Reyhford STIX indicators into Splunk Enterprise Security via TAXII 2.1.

Connect Splunk Enterprise Security (ES) to the Reyhford TAXII 2.1 feed for automated threat intelligence ingestion.

## Prerequisites

* Splunk ES with Threat Intelligence Management
* Reyhford API key from [app.reyhford.com](https://app.reyhford.com)

## Configure TAXII feed

1. In Splunk ES, go to **Configure → Content → Threat Intelligence Management → New Threat Intelligence Collection**.
2. Select **TAXII** as the source type.
3. Enter server details:

| Field              | Value                              |
| ------------------ | ---------------------------------- |
| Server URL         | `https://api.reyhford.com/taxii2/` |
| Collection         | `reyhford-global-feed`             |
| Username           | (leave blank)                      |
| Password / API Key | Your Reyhford API key              |
| Version            | TAXII 2.1                          |

4. Set polling interval to **15–60 minutes** (recommended).
5. Enable **Use added\_after** for incremental updates.

## STIX mapping

Reyhford returns STIX 2.1 `indicator` objects with:

* `pattern` — observable (IPv4, port, protocol)
* `kill_chain_phases` — MITRE tactic mapping
* Custom extensions — `x-reyhford-reputation` for IP history

Splunk ES maps STIX indicators to notable events based on your correlation searches.

## Verification

```bash theme={null}
# Confirm feed connectivity outside Splunk
curl -s "https://api.reyhford.com/taxii2/collections/reyhford-global-feed/objects/?limit=1" \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1" | jq '.objects | length'
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    Verify the API key is active and passed as `Bearer` token. Discovery works without auth; objects require a key.
  </Accordion>

  <Accordion title="Empty feed">
    Indicators must reach `ENRICHED` or `VERIFIED` state before appearing in the feed. Check [status.reyhford.com](https://status.reyhford.com).
  </Accordion>
</AccordionGroup>

## Related

* [TAXII Discovery](/api-reference/taxii/discovery)
* [Authentication](/authentication)