Integrating with the Australian Signals Directorate’s Cyber Threat Intelligence Sharing Service

The Australian Signals Directorate’s (ASD’s) Cyber Threat Intelligence Sharing (CTIS) service is a two-way threat intelligence (TI) sharing platform that enables government and industry partners to receive and share information about malicious cyber activity bidirectionally. 

Splunk Enterprise Security (ES) supports integration with the CTIS service for both ingestion of indicator of comprise (IOCs) information natively with the ES Threat Intelligence Framework (TIF) and via an open source Splunk developed plugin for IOC reporting. This plugin enables partners to share IOCs with CTIS for others to consume. The open-source plugin is available in this Splunk GitHub repository. 

CTIS supports multiple different TI feeds via what is known as Collections. Each CTIS Collection provides an IOC feed for a specific category of indicators, generally based on their criticality and/or their source. These Collections are all detailed in the CTIS documentation which is available on the Australian Cyber Security Centre (ACSC) Partner Portal. Membership is required to access the portal and to use the CTIS service. Any Australian-based organisation who are not currently ACSC partners and would like to utilize this service can find further information on applying to become a partner on the ACSC website.