top of page
Digital Lock.png

Scout App

Enrich Splunk, accelerate IR and enhance investigations with Real-time IP Intelligence


Enhance Your Security Operations With Real-Time IP And Domain Intelligence

Splunk customers benefit from real-time IP and domain intelligence through a partnership with Team Cymru. Accelerate incident response, enhance investigations, and reduce false positives by enriching Splunk dashboards with the world's largest IP data ocean.

Quickly identify and mitigate threats with real-time data

Gain deeper insights and context for thorough investigations

Improve accuracy and efficiency by minimizing false alerts

Use Cases

Splunk Data Sheet 2.png

Enrich any IP address with insightful context, tags and metadata

Gather detailed views of IP address relationships, including communication patterns, open ports, passive DNS data, X509 certificates, fingerprints, and WHOIS information.

Provide Real-time Context
to Splunk Investigations

Obtain critical information about multiple IP addresses that appear in alerts or security incidents

Splunk 2.png
Splunk 3.png

Domain and IP Research

Leverage the world's largest data ocean to quickly and easily triage and investigate any IP address, or domain. Search a single IP or bulk research by querying up to 10 IP addresses at once. Empower SOC teams with context to accelerate IR and investigations.

Enhanced Log Management with Team Cymru Scout App for Splunk

Parsing, Normalizing, &
Analyzing Logs

As the Team Cymru Scout App ingests logs, they are parsed, normalized, and stored within Splunk. This enables you to write detections, identify anomalies, and conduct investigations across extensive datasets.

Normalization: The app applies standardized fields to log records allowing for consistent attribute names and facilitating data correlation across multiple sources.

Analysis Tools: Utilize Splunk's search tools, such as the Search Processing Language (SPL), to investigate your normalized logs for suspicious activities or vulnerabilities

People in a futuristic data center.png

Built-In And Easily Customizable Detections

Obtain critical information about multiple IP addresses that appear in alerts or security incidents

Pre-built Detections: Access default detections tailored for common threats and loCs.

Custom Detections: Leverage plunk's powerful SPL to create custom detection logic, allowing you to define rules specific to your organization's needs

Configuring Alerts

The app generates alerts based on your configured detection rules and policies. These alerts can be integrated with various destinations for intuitive management and remediation.

Severity Levels: Alerts are categorized into different severity levels -- Info, Low, Medium, High, and Critical. Customize these levels based on specific log event attributes.

Alert Destinations: Integrate alerts with Splunk's alert actions to send notifications to email, Slack, or other SOAR platforms

IT Error Alert.png

Integration with Splunk is easy. Follow these steps

Download Scout App

Download and install the Team Cymru
Scout App from Splunkbase.


Configure data inputs

Detection-as-Code boosts Splunk
efficiencv instantlv. Create detections


API key setup

Detect threats in real-time and
searchable security data for one vear.

Check Box.png

Verify data collection

Detect threats in real-time and
searchable security data for one vear.

Install and configure the Splunk App from Splunkbase

Loved by SOC Analysts

Why Team Cymru and Splunk Are a Winning Combination

Team Cymru and Spunk provide a robust solution for comprehensive cybersecurity and threat intelligence. Team Cymru's detailed threat intelligence feeds and extensive data on IP address relationships, combined with Splunk's powerful data analysis and visualization capabilities, create a powerful synergy.

Splunk's ability to ingest, normalize, and analyze vast amounts of data is complemented by Team Cymru's real-time threat intelligence, enabling security teams to detect and respond to threats swiftly and effectively. This integration allows organizations to gain deeper insights into their network activities, identify and mitigate potential risks, and maintain a proactive security posture.

By leveraging the strengths of both platforms, security teams can streamline their workflows, enhance their threat detection and response capabilities, and ultimately protect their digital assets more efficiently.

The Ideal SIEM for Threat Intelligence

With the Team Cymru Scout App for Splunk, your security team can efficiently manage threat intelligence and digital risk without the overhead associated with traditional SIM solutions

bottom of page