Criminal IP launches Splunk app to correlate threat intelligence

Criminal IP, the AI-powered threat intelligence and attack surface management platform from AI SPERA, has launched the Criminal IP TI Feed app for Splunk. Available through Splunkbase, the app automatically correlates Criminal IP threat intelligence with firewall traffic logs indexed in Splunk, enabling security teams to determine whether assets connected to malicious IPs and whether sessions were completed.

The integration broadens Criminal IP’s Splunk ecosystem beyond simple IP lookups and fraud detection, helping SOC teams pinpoint high-priority threats within existing workflows.

The TI Feed app links inbound and outbound threat feeds with firewall activity to classify network sessions by outcomes such as completed, unanswered, denied, neutral, and unknown. Severity is derived from actual firewall activity, with detections lacking a completed session capped at the watch tier and those indicating a successfully established malicious session flagged as critical.

The app schedules Criminal IP TI Feed data downloads every three hours and runs correlation searches against firewall traffic every 10 minutes, writing results to a dedicated summary index for efficient dashboards and alerts. A daily retrospective search compares the latest threat intelligence with the previous 30 days of traffic to surface historical communications.

Seven dashboards—Overview, Investigate, All Detections, IP Lookup, Trends, Alerts, and Health—present asset impact, malicious IPs, traffic direction, session status, severity, and feed health, with optional Slack alerts grouped by IP and direction. AI SPERA CEO Byungtak Kang is quoted emphasising the actionable value of connecting threat intelligence to network activity.