AI SPERA has released the Criminal IP TI Feed application on Splunkbase. The tool integrates threat intelligence from the Criminal IP platform with firewall traffic logs stored in Splunk to automate threat detection and incident prioritization for security operations centers.
The application correlates inbound and outbound threat data with firewall logs every 10 minutes, while feed data is updated every three hours. It classifies network activity based on session outcomes such as completed, denied, or unanswered connections, allowing analysts to focus on high-priority threats where a session with a malicious IP was established.
A retrospective search feature scans the previous 30 days of firewall traffic against current threat intelligence to identify past interactions with newly flagged malicious addresses. The system includes seven dedicated dashboards for monitoring traffic, assets, and detection history, alongside automated Slack alerts that group notifications to prevent alert fatigue.
Criminal IP is the flagship platform of AI SPERA and is currently utilized in over 150 countries. The company continues to expand its ecosystem through integrations with major cloud providers and data marketplaces, including Amazon Web Services, Microsoft Azure, and Snowflake.