Torrance, USA, November 11th, 2026, CyberNewswire
Criminal IP, the AI-powered threat intelligence and attack surface management platform developed by AI SPERA, has launched the Criminal IP TI Feed app for Splunk.
Available through Splunkbase, the app automatically correlates Criminal IP threat intelligence with firewall traffic logs collected in Splunk.
The integration enables security teams to determine whether organizational assets communicated with malicious IP addresses and whether sessions were successfully established.
It also expands Criminal IP’s existing Splunk ecosystem beyond individual IP lookups and fraud detection, helping SOC teams identify high-priority threats within their existing Splunk workflows.
Connecting Threat Intelligence with Network Activity
Security teams often receive large volumes of IP reputation alerts without enough context to determine whether a connection was attempted, blocked, unanswered, or successfully established.
This can make it difficult to distinguish routine scanning from communications that require immediate investigation.
The Criminal IP TI Feed app addresses this challenge by correlating inbound and outbound threat intelligence feeds with firewall traffic already indexed in Splunk.
Network activity is classified according to observed session outcomes, including completed, unanswered, denied, neutral, and unknown connections.
Severity is also determined using actual firewall activity.
Detections without a completed session cannot exceed the watch tier, while critical detections indicate that a session with a malicious IP was successfully established.
This helps analysts prioritize incidents with the greatest potential impact.
Automated Correlation and Retrospective Detection
.webp)
The app downloads Criminal IP TI Feed data every three hours and runs correlation searches against firewall traffic every 10 minutes. Results are written to a dedicated summary index, allowing dashboards and alerts to operate without repeatedly searching large volumes of raw logs.
A daily retrospective search compares the latest Criminal IP threat intelligence against the previous 30 days of firewall traffic. This helps identify historical communications with IP addresses that were not recognized as malicious when the activity originally occurred.
Seven dashboards- Overview, Investigate, All Detections, IP Lookup, Trends, Alerts, and Health- provide visibility into affected assets, malicious IP addresses, traffic direction, session status, severity, detection history, and feed collection health.
The app can also deliver consolidated Slack alerts grouped by malicious IP address and traffic direction. These alerts retain asset-level details, including session counts, timestamps, and transferred data, while throttling repeated notifications to reduce alert fatigue.
Advancing Intelligence-Driven Security Operations
By connecting external threat intelligence with actual network activity, the Criminal IP TI Feed app provides the context analysts need to identify which assets interacted with malicious infrastructure and which detections require immediate attention.
Automating feed collection, log correlation, historical analysis, dashboards, and alerts reduces manual investigation and helps SOC teams respond to meaningful threats more efficiently.
AI SPERA CEO Byungtak Kang stated, “Threat intelligence becomes significantly more actionable when connected to the network activity occurring inside an organization. The Criminal IP TI Feed app for Splunk helps security teams identify affected assets and prioritize incidents based on observed session behavior.”
About Criminal IP
Criminal IP is AI SPERA’s flagship cyber threat intelligence platform. Used in more than 150 countries, it provides comprehensive threat visibility through Criminal IP Search, Criminal IP ASM, Criminal IP FDS, and Criminal IP TI Feed.
Criminal IP continues to expand its global security ecosystem through integrations and strategic partnerships. Its threat intelligence is also accessible through major cloud and data marketplaces, including Amazon Web Services, Microsoft Azure, and Snowflake.
Users can learn more and download the app from Splunkbase:
Michael Sena
AI SPERA
[email protected]
