Criminal IP Unveils New TI Feed App on Splunkbase for Enhanced Threat Detection

Torrance, USA, November 11th, 2026, CyberNewswire

In a significant development within the realm of cybersecurity, Criminal IP announced the launch of its new Threat Intelligence (TI) Feed app, specifically designed for integration with Splunk. This innovative application is intended to bolster automated threat detection processes for organizations utilizing Splunk for their security operations. Criminal IP is an AI-powered threat intelligence and attack surface management platform, developed by AI SPERA, and aims to enhance the efficacy and responsiveness of security teams confronting various cyber threats.

The newly introduced TI Feed app is now accessible through Splunkbase, which is Splunk’s marketplace for applications. By automatically correlating threat intelligence from Criminal IP with firewall traffic logs that have been logged into Splunk, the app facilitates a more nuanced approach to identifying potentially harmful activities. This means security teams are now more equipped to ascertain whether their organizational assets have communicated with known malicious IP addresses and whether any sessions were successfully established during those communications.

Moreover, the TI Feed app does more than just individual IP lookups or fraud detection; it significantly expands Criminal IP’s existing features within the Splunk environment. This enhancement allows Security Operations Center (SOC) teams to better prioritize high-risk threats while remaining entrenched in their existing Splunk workflows, thus making their operations both efficient and effective.

Connecting Threat Intelligence with Network Activity

In the often chaotic landscape of cybersecurity, security teams frequently receive an overwhelming amount of alerts pertaining to IP reputations, yet these alerts often lack the necessary context for actionable decision-making. For instance, distinguishing whether a connection was merely scanned, blocked, unanswered, or successfully established poses a considerable challenge. Typically, this ambiguity can blur the lines between routine network activity and critical incidents that warrant immediate investigation.

The Criminal IP TI Feed app addresses these challenges head-on. Its ability to correlate both inbound and outbound threat intelligence feeds with already indexed firewall traffic in Splunk empowers analysts to classify and scrutinize network activity based on actual session results. Various observed outcomes are classified into categories such as completed, unanswered, denied, neutral, and unknown connections, allowing for a granular understanding of potential threats.

The app also determines severity based on real firewall activity rather than relying solely on theoretical categorizations. For instance, detections linked to incomplete sessions could be flagged within a lower watch tier, whereas critical detections indicate that a successful communication with a malicious IP had occurred. This level of detail significantly aids analysts in prioritizing threats that have the highest potential for impact on their networks.

Automated Correlation and Retrospective Detection

One of the standout features of the TI Feed app is its capability for automated correlation and retrospective detection. The app is programmed to download Criminal IP TI Feed data every three hours and conducts correlation searches against firewall traffic every ten minutes. These results are streamed into a dedicated summary index, thereby allowing dashboards and alerts to function without the need to continuously sift through expansive volumes of raw log data.

In addition, a daily retrospective search is undertaken, comparing the most recent Criminal IP threat intelligence against the previous thirty days of firewall data. This function aims to uncover historical communications with IP addresses that might not have been flagged as malicious at the time of occurrence, but could now be understood as threats.

The app features seven dashboards—Overview, Investigate, All Detections, IP Lookup, Trends, Alerts, and Health—that provide a comprehensive overview of affected assets, detected malicious IP addresses, traffic directions, session statuses, severity levels, and detection history.

Advancing Intelligence-Driven Security Operations

By seamlessly linking external threat intelligence to real-time network activity, the Criminal IP TI Feed app equips analysts with the contextual knowledge essential for identifying which organizational assets engaged with potentially harmful infrastructures and determining which incidents necessitate immediate scrutiny.

AI SPERA CEO Byungtak Kang articulated that the app transforms how threat intelligence is perceived, stating, “Threat intelligence becomes significantly more actionable when connected to the network activity occurring inside an organization. The Criminal IP TI Feed app for Splunk helps security teams identify affected assets and prioritize incidents based on observed session behavior.”

About Criminal IP

Criminal IP operates as AI SPERA’s flagship cyber threat intelligence platform and is utilized in over 150 countries worldwide. The platform offers an extensive array of tools designed for comprehensive threat visibility, including Criminal IP Search, Criminal IP ASM, Criminal IP FDS, and now the Criminal IP TI Feed.

As part of their ongoing commitment to cybersecurity, Criminal IP is actively enhancing its global security ecosystem through various integrations and strategic partnerships. The platform’s threat intelligence is conveniently accessible across major cloud and data marketplaces, including Amazon Web Services, Microsoft Azure, and Snowflake.

For those interested, the TI Feed app is available for download on Splunkbase, allowing organizations to augment their security posture effectively.

As digital threats continue to evolve, so too does the importance of integrating intelligence-driven solutions like Criminal IP’s TI Feed app, ultimately enabling organizations to foster a robust defense against an array of cyber adversities.

Source link