Command-and-control IPs from your IOC feeds, mapped by origin, and a generated Splunk search that matches every active, decaying indicator against your events.
The origin map
/threat-intel/infrastructure shows the command-and-control IPs your feeds report: a choropleth of origin countries (click a country for its indicators), a list searchable by IP, malware family or country and filterable by feed and location, and a detail panel per IP — origin country, hosting ASN, hostname, port, status, first seen and last online.
IPv4 entries only. The map and list are built from the organisation's 150 most recent feed entries, keeping those whose identifier is an IPv4 address. In practice that is the built-in Feodo Tracker C2 IPs feed, or a custom JSON or CSV feed whose records are keyed by IP. ThreatFox and URLhaus entries are not keyed by IP and do not appear here.
Organisation-wide. Feeds of both scopes feed this page; the active-workspace selector does not change it.
Off until you enable a feed. The abuse.ch feeds ship disabled. Enable one on /threat-intel/feeds and sync it, or this page stays empty.
IOC matching
When any indicator is active, the IOC matching panel shows the organisation's active-indicator count, a breakdown by observable type, and Preview Splunk rule. The count covers every active indicator from every feed that produces them — IPs, domains, URLs and hashes — not only the IPs listed on this page, so the two numbers can differ.
What it generates. A lookup, talon_ioc_indicators (up to 50,000 indicators, each with its current score), and a saved search, [Talon - IOC Match], scheduled every five minutes over the last five minutes of index=*. It compares common CIM fields (src_ip, dest_ip, domain, url, file_hash and others) with the lookup.
You install it. Talon does not deploy or run this search. Preview it, then install it as a scheduled search on your Splunk search head, narrowing the index for your volume.
Scores decay. An indicator's score falls over its lifetime, so a fresh indicator counts for more than a month-old one, and indicators whose score reaches zero drop out of the lookup. See Threat Feeds for how scores are set.