Add HoneyLabs as a threat intelligence source in Splunk ES

Splunk ES has a threat intelligence framework that downloads threat lists on a schedule and matches them against your data. It takes a plain URL, so the two public HoneyLabs feeds drop straight in with no account, no add-on and no code. Once indicators are landing you can swap the fixed public list for a feed shaped by your own query.

Add the exploiter feed

In ES, open Configure > Threat intelligence > Threat intelligence sources and add a URL-based source. This list is source IPs our sensors caught running exploit or loader payloads in the last seven days, so it is small and high-precision rather than a dump of everything that touched a honeypot. No credentials: the two public feeds are open.

Name              : honeylabs_exploiters
Type              : ip
URL               : https://honeylabs.net/feed/exploiters.csv
Delimiting regex  : ,
Fields            : ip:$1,description:$7
Skip header lines : 1
Download interval : 3600

# The CSV columns the mapping above refers to:
# ip,first_seen,last_seen,events,asn,country,reference
#  1     2          3       4     5     6        7

Add the malware infrastructure feed

Second source, different shape: staging URLs our honeypots were told to download from, captured out of the payload itself. The column order differs from the exploiter feed, so the mapping differs too. Point it at ES's URL intel collection rather than IP.

Name              : honeylabs_malware_infra
Type              : url
URL               : https://honeylabs.net/feed/malware-infrastructure.csv
Delimiting regex  : ,
Fields            : url:$1,description:$6
Skip header lines : 1
Download interval : 3600

# Columns here:
# url,host,first_seen,last_seen,hits,reference
#  1    2      3          4      5       6

03
Check it actually imported
Do not take the form's word for it. ES logs every threat list download, and the collection either has rows or it does not. If the count is zero, the field mapping is the thing to look at first: ES versions differ slightly in what they call these settings, and a mapping that does not match the column order imports nothing without erroring.
```
| rest /services/data/inputs/threatlist
| search title="honeylabs*"
| table title url disabled

# Did rows land?
| inputlookup ip_intel where source="honeylabs_exploiters"
| stats count

# ES also shows this under Audit > Threat Intelligence Audit
index=_internal sourcetype=threatlist source=*honeylabs*
```

Confirm it is matching your traffic

Once indicators are in the collection, ES correlates them against your data automatically and writes matches to threat_activity. That is the search worth saving: it tells you which of your own hosts talked to something our sensors have already seen attacking.

| tstats count from datamodel=Threat_Intelligence.Threat_Activity
  where Threat_Activity.threat_collection="ip_intel"
  by Threat_Activity.src, Threat_Activity.threat_match_value

# Every indicator carries a reference URL back to the evidence,
# so an analyst can open the full report for any match:
# https://honeylabs.net/lookup/<ip>

Narrow it to the traffic you care about

The two public feeds are fixed lists. A free account lets you save any HoneyLabs query and mint a feed URL for it, which the public feeds cannot give you: SSH brute-forcers with known researchers removed, one specific CVE, one ASN. Same ES setup, different URL, and the CSV columns match the exploiter feed so the mapping above is unchanged.

# Save a query on https://honeylabs.net/feeds, then mint a token
port:22 AND NOT tag:scanner     # SSH brute-forcers, researchers removed
cve:CVE-2024-4577               # IPs probing one specific CVE
asn:14061 AND port:445          # SMB scans out of one network

# Then point ES at it instead
URL : https://honeylabs.net/feed/<token>.csv

# Get the account and token here:
https://honeylabs.net/dashboard?src=splunk-es

06
Or take STIX over TAXII instead
ES speaks TAXII 2 natively, and our TAXII server returns full STIX objects rather than a flat list: confidence derived from the observed evidence, kill-chain phase, and labels you can filter on. Any HoneyLabs API key works as the password, including a free one. The free window is seven days of exploiters and fourteen of malware infrastructure; a paid plan widens both and adds the CVE-prober collection.
```
Discovery URL : https://honeylabs.net/taxii2/
API root      : https://honeylabs.net/taxii2/api/
Collection    : exploiters
Username      : taxii
Password      : <your API key>

# Collections available
exploiters                 free
malware-infrastructure     free
attackers                  free
cve-probers                paid
```

Worth knowing

ES cannot use an authenticated proxy with a TAXII feed. If yours requires auth, use the URL-based feeds above instead, which go through ordinary HTTP.
Responses are edge-cached for five minutes, so a shorter download interval costs you nothing and gains you nothing. Hourly is fine.
If the CSV mapping gives trouble, the same feeds serve plain text at the URL without an extension: one IP per line, no header, which ES reads with ip:$1 and no delimiter.
Every row carries a reference URL to the full report for that indicator, so a match in ES is one click from the evidence behind it rather than a bare address.

Both public feeds are open, so steps 01 and 02 need no account and nothing to install. The account only buys you a feed shaped by your own query, which you save on the feeds page. The same setup works in any SIEM that reads a threat list from a URL, so see the other integrations if you run more than one.