Modular Inputs

Populates the Splunk ES threat intelligence framework with scored indicators from the Whisper explain() API.

Output: sourcetype=whisper:threat_intel

Where do threat indicators come from?

The input populates two KV Store collections:

These integrate with ES via the threat intelligence framework. Correlation searches reference them automatically.

Automatic seeding: On first run, when both KV Store collections are empty, the input automatically queries the Whisper Knowledge Graph for IPV4 and HOSTNAME nodes with threatScore > 0. This bootstraps the collections so threat intelligence flows immediately without manual setup.

After the first run, the input re-assesses all existing indicators in the collections on each interval. To add new indicators, insert them into the appropriate collection:

| makeresults
| eval ip="203.0.113.50", description="Suspicious IP from investigation"
| outputlookup whisper_ip_intel append=true

| makeresults
| eval domain="malicious-example.com", description="Phishing domain"
| outputlookup whisper_domain_intel append=true

Verification:

| inputlookup whisper_ip_intel | head 10
| inputlookup whisper_domain_intel | head 10

Collects DNS infrastructure snapshots for monitored domains. Used by the DNS Infrastructure Change Detection correlation search.

How to specify domains

Enter the domains you want to monitor as a comma-separated list in the Domains field when configuring the input. For example:

example.com, corp.example.com, subsidiary.com

The input discovers the full DNS infrastructure for each domain (A records, nameservers, mail servers, CNAME chains, and subdomains). You do not need to list subdomains individually — they are discovered automatically.

Records collected per domain:

Outputs:

The input keeps a per-domain snapshot in the modular input checkpoint after each run. The next run compares the new baseline against the saved snapshot and emits change events. The first run after install therefore produces only baseline events; change detection begins on the second run.

Each record is also written to the whisper_dns_baseline KV Store collection. That collection seeds the Watchlist Enrichment input (see below).

Verification:

`whisper_index` sourcetype="whisper:attack_surface" | stats count by domain, record_type

Pre-computes enrichment for a custom list of indicators, storing results in KV Store for instant lookup without live API calls.

Output: sourcetype=whisper:watchlist

Results are stored in the whisper_precomputed_enrichment KV Store collection. The whisperlookup command checks this collection before making live API calls.

How to populate the watchlist

The input enriches all indicators in the whisper_watchlist KV Store collection. Each record has three fields:

Add indicators via SPL:

| makeresults
| eval indicator="example.com", indicator_type="domain", description="Primary domain"
| append [| makeresults | eval indicator="203.0.113.50", indicator_type="ip", description="Critical server"]
| outputlookup whisper_watchlist append=true

Bulk-load from existing Splunk data:

index=firewall action=blocked
| stats count by dest_ip
| where count > 100
| rename dest_ip AS indicator
| eval indicator_type="ip", description="Frequently blocked IP"
| outputlookup whisper_watchlist append=true

View current watchlist:

| inputlookup whisper_watchlist

Automatic seeding: When the watchlist collection is empty and an Attack Surface Baseline input has already run, the watchlist input automatically seeds itself with domains from the whisper_dns_baseline collection. This means your organization's known infrastructure domains are enriched by default without manual setup. You can add or remove indicators at any time after seeding.

Verification:

| inputlookup whisper_precomputed_enrichment | head 10

All inputs respect the API rate limit. Intervals shorter than the minimum are rejected during configuration.