Splunk HEC
Push IOCs and SOC events through HTTP Event Collector, configured in the dashboard. Not a Splunkbase app.
Solutions
SIEM Integration Threat intelligence for your SIEM
Push indicators to Splunk, Elastic or Sentinel, or poll TAXII 2.1. Feed access requires Pro or Enterprise.
Pro: €99/month. Enterprise: quotation. TAXII polling does not consume the monthly lookup quota. The Free plan does not include feed access.
By the numbers
Threat intel your SIEM would consume
Current indicator counts available through TAXII and the API.
Current data sample
public samplepublic sample
29 986 142
Total threats
20 416 459
Malicious domains
9 569 683
Malicious IPs
591
Sources in the corpus
By the numbersUpdated Oct 17, 03:33 UTC · Counters read at 2026-10-17T06:25:18.125Z. Indicator dates vary by source.public sample
Start with a free report
No credit card required · Free: a 10% sample of each list · full lists on paid plans
- Dashboard destinations
- 3
- Indicator format
- STIX
- Feed transport
- API
- Lookup API
- JSON
Capabilities
Key features at a glance.
Elastic
Index IOCs through the Elastic Bulk API from the dashboard. Not a Fleet package.
Microsoft Sentinel
Ingest indicators with Sentinel’s built-in TAXII connector. Optional Log Analytics destination for events.
STIX/TAXII Feeds
Poll TAXII 2.1 collections of STIX 2.1 indicators with any client your SIEM supports.
API Integration
REST API for custom enrichment inside your SIEM pipelines.
Applications
Use cases to evaluate first.
Event Enrichment
Add source context to selected events, then review the result.
Alert Correlation
Match events against imported indicators, keeping source context for review.
Threat Detection
Write detection rules on imported indicators.
Compliance
Keep imported indicators and their sources as audit evidence.
In depth
Worth knowing before you start.
Review the source before changing a rule
Check the returned reputation, source evidence and dates against your telemetry before adding a blocking rule. A score alone proves neither attribution nor intent.
FAQ
Frequently asked questions.
Which SIEM platforms do you support?
Dashboard destinations for Splunk HEC, Elastic bulk ingest, and Microsoft Sentinel Log Analytics. QRadar, Chronicle, and other platforms consume STIX/TAXII or the REST API — there is no native QRadar or Chronicle app.
How is data delivered to the SIEM?
A dashboard destination (Splunk HEC, Elastic Bulk, Sentinel Log Analytics), TAXII polling, or direct REST enrichment.
Does it slow down my SIEM?
Measure lookup latency, import time and event throughput in your own deployment. Caching and asynchronous workflows reduce repeated calls; no performance gain is promised.
Can I customize which data is ingested?
Select collections and the documented endpoint filters, configure mapping and retention in your SIEM, then check the imported volume.
Research
Related articles from the research blog.
Blog post
TAXII Threat Feeds: Build a Continuous SIEM Integration
Connect an isMalicious TAXII collection to your SIEM with safe pagination, durable checkpoints, validation, monitoring, and recovery.
Read more
Blog post
STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines
How to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.
Read more
Blog post
IOC Expiration: When to Remove an IP From a Blocklist
Manage IOC expiration with separate DNS, evidence and STIX validity clocks. Review stale IP blocks, process withdrawals and preserve the audit trail.
Read moreTest it with your own indicators.
Tell us your current tool, the gap to close, expected volume and decision date. We scope an evaluation against your sources.
Pro: €99/month. Enterprise: quotation. TAXII polling does not consume the monthly lookup quota. The Free plan does not include feed access.