Enrich SIEM alerts

Prerequisites and plan required

Use a Professional or Enterprise organization-bound events key to collect the firewall EDL JSON feed. You need a secret-aware collector, permission to configure your SIEM, and local alert fields mapped to the v1 schema. Start with the v1 starter pack. The pack includes offline conversion and templates; it does not install a hosted connector or make requests on your behalf.

Expected result: local alerts are joined to current, unexpired observation evidence for analyst review. The templates do not perform unconditional blocking or account disablement. Validate syntax and field mappings against your installed product version before enabling scheduled rules.

1. Collect and normalize the feed

Follow Console → Integrations for feed authentication. Fetch GET /api/v1/feeds/edl?format=json&min_confidence=80 through your approved collector. Keep its key in a secret manager, outside search definitions and source control. TXT drops the metadata required by these templates.

Each entry needs ip, reason, confidence, first_seen, last_seen and expires_at. IPs are canonical individual IPv4/IPv6 addresses, with exact-equality matching. Treat reason as untrusted text. Confidence is 0–100 observation confidence, not compromise probability. Retain expiry with every match and discard expired indicators. The pack's sample is synthetic documentation data and must not be presented as observed threat infrastructure.

Use the offline converter described in the pack to create the six-column CSV where needed. Refresh the complete current selection, including deletions, rather than appending indicators forever. Use the firewall guide for feed expiry, refresh cadence and empty-on-error behavior.

2. Configure Splunk

Install the pack's transforms.conf in your private app's local directory and place the converted CSV at lookups/mothlight_ips.csv. Map src_ip, event_kind and event_type to your local alerts and select the correct index. Run the provided searches interactively and inspect matches first.

The scheduled examples are disabled, run every 15 minutes over the previous 15 minutes, and contain no response actions. Your collector must refresh the CSV before the scheduled search. Review scheduler timing and deduplication before enabling it. No outbound request or API key belongs in SPL.

3. Configure Microsoft Sentinel

Create a Watchlist alias mothlight_ips from the CSV and choose ip as SearchKey. Import all six columns exactly. Your collector must replace or delete retired rows: Watchlist refresh alone is not an indicator expiry policy.

Adapt signinlogs.kql and commonsecuritylog.kql to your workspace and connectors. Replace the local verified-exploit-signature placeholder with signatures your team has validated. Review candidate incidents without attaching blocking automation. Preserve last_seen and expires_at in the investigation record.

4. Configure Elastic and Sigma

For Elastic, create the index and enrich policy using the pack's request bodies, load current indicator documents, and execute the enrich policy. Policies are snapshots: replace/delete retired documents and execute again after each successful refresh. Serialize refreshes; use a staging index and alias switch for atomic production updates. Adapt index names, field types and ES|QL to your installed version. The detection rule is a disabled Kibana API request body, not an NDJSON import file.

Sigma templates require backend-specific enrichment. Importing YAML alone does not create a portable lookup join. Map the normalized fields and custom event types before translating rules to your backend.

Troubleshooting and expected review

Missing matches commonly mean a field mismatch, stale lookup snapshot or expired indicator. Verify canonical IP equality, collector timestamps and deletion behavior before weakening filters. Shared IPs can belong to unrelated users; correlate with your alert evidence and review reversible responses. Not seen means unknown, never safe. Use IP triage for individual cases and Collect events for a separate observation collection pipeline.