DocsSplunk

Splunk

The SPLUNK alert channel forwards every ThreatIntellix alert to your Splunk instance via HTTP Event Collector (HEC): watchlist score spikes today, more alert types land here automatically as they ship (typosquat findings already do).

1. Create a HEC token in Splunk

Settings → Data Inputs → HTTP Event Collector → New Token.
Name it (e.g. threatintellix), select or create a source type (threatintellix works fine as a bare label), and pick the index you want alerts to land in.
Confirm HEC is enabled globally (Settings → Data Inputs → HTTP Event Collector → Global Settings → "All Tokens" enabled) and note the port (default 8088).
Copy the generated token.

2. Configure the channel

In Settings → Alert channels, add a Splunk (HEC) channel with your HEC URL (https://your-splunk:8088/services/collector/event), the token from step 1, and optionally the index/sourcetype if you want to override Splunk's token defaults per-channel.

3. Event shape

Every field from the alert lands flattened inside event, plus an event_type discriminator, the same underlying data as the generic webhook's data field.

{
  "event": {
    "event_type": "watchlist.score_spike",
    "ioc": "185.220.101.45",
    "type": "ip",
    "oldScore": 10,
    "newScore": 85,
    "verdict": "VT: 12/70 engines flagged | OTX: 3 pulses"
  },
  "sourcetype": "threatintellix",
  "time": 1755781200.0
}

4. Example search

Once events are flowing, a starting SPL query for high-severity watchlist spikes:

index=threatintel sourcetype=threatintellix event_type=watchlist.score_spike
| where newScore > 70
| table _time ioc type oldScore newScore verdict