SIEM

Splunk

Trusteed Connector enriches Splunk with IP, risk score, and threat category in air-gapped SOCs — no internet exposure required.

Prerequisites

Splunk Enterprise or Splunk ES (7.3+)
Trusteed account with IP Enrichment feed access
Trusteed Splunk Connector (provided by Trusteed)
Admin access to Splunk for creating lookup/KV store collections

Setup Steps

1. Deploy the Connector

Install the Trusteed Connector on a bridge server with outbound internet and secure access to Splunk (via REST API or CLI).
Configure credentials in config.yml (Trusteed API, Splunk HEC token / username-password, lookup name).

2. Fetch Trusteed Feed

Connector automatically pulls the feed:

IP, RiskScore, Category, FirstSeen, LastSeen 192.168.38.187,95,Botnet,2025-09-01,2025-09-20 192.168.38.186,70,Scanner,2025-09-05,2025-09-19

3. Load Data into Splunk

Two supported methods:

Option A — KV Store Collection

Connector pushes data into a KV Store collection called trusteed_ip_enrichment.
Fields: IP, RiskScore, Category, FirstSeen, LastSeen.

Option B — CSV Lookup File

Connector writes trusteed_blocklist.csv into $SPLUNK_HOME/etc/apps/search/lookups/.
Lookup is automatically refreshed on schedule.

4. Automate Updates

Connector runs as a scheduled service (systemd/cron).
Default sync interval: every 15 minutes (configurable).
Logs and alerts track feed freshness.

5. Use in Searches & Correlation

Example SPL query (enrichment join):

index=firewall_logs | lookup trusteed_ip_enrichment IP as src_ip OUTPUT RiskScore, Category | where RiskScore > 80 | stats count by src_ip, Category, RiskScore

Example correlation search in ES:

Trigger an alert when RiskScore > 80 and event matches Trusteed feed.

Outcome

Splunk stays fully air-gapped, no direct internet required.
Analysts see IP + Risk Score + Category + Timeline in searches and alerts.
Noise is filtered, false positives reduced, high-risk IPs surface faster.
SOC teams save time by working with enriched, high-fidelity signals.

Next Steps

Extend enrichment with domains or URL feeds.
Chain Trusteed lookups into Splunk Phantom (SOAR) playbooks.
Explore more Trusteed integrations in the catalog.

‍