Cisco Talos Intelligence Setup

Prerequisites

Tool or access	Purpose	Verify
Bash	Run package and completion checks	bash --version
ES Cloud admin access	Install and validate Talos	Confirm administrative access
Service certificate	Authorize enrichment	Verify without printing it

Workflow Overview

┌───────────┐   ┌────────────────┐   ┌───────────────────┐   ┌─────────────────────┐
│ Preflight │ → │ Install add-on │ → │ Verify capability │ → │ Validate enrichment │
└───────────┘   └────────────────┘   └───────────────────┘   └─────────────────────┘

When to Activate

• Install or validate Splunk_TA_Talos_Intelligence in ES Cloud.
• Check Talos service-account certificate and capability readiness.
• Diagnose failed enrichment, adaptive response, or threat-list state.

Scope

This skill validates the supported ES Cloud integration surface. It does not mint certificates, enable deprecated blacklist collection silently, or claim support for an unverified self-managed topology.

Examples

Install the reviewed Talos package path:

bash skills/cisco-talos-intelligence-setup/scripts/setup.sh --install

Expected output: the package is installed through the supported topology path, or a precise ES Cloud administrative handoff is emitted.

Run the strict readiness gate:

bash skills/cisco-talos-intelligence-setup/scripts/validate.sh --completion

Expected output: package, certificate, get_talos_enrichment, adaptive action, and disabled-threat-list checks report [PASS] or exit nonzero.

Troubleshooting

Issue	Cause	Resolution
Enrichment capability is absent	Role or package setup is incomplete	Correct ES capability mapping and retest
Certificate fails	Material is missing/expired	Renew through its owner
Adaptive response fails	Permissions/app state is incomplete	Verify ES action setup
Legacy blacklist is enabled	Unsupported threat-list state remains	Review and disable it before completion

TA Completion Gate

For every TA/add-on or dashboard companion run, satisfy the shared TA completion gate: configure and enable the data ingest path owned by this skill or its required companion, validate events or metrics in the target indexes/source types, and verify any pre-built/package-shipped dashboards are visible, macro-aligned, and returning data. If the package ships no dashboards, record that evidence explicitly and hand off dashboard use to the consuming app, ES/ITSI/ARI content, or readiness doctor.

Automates readiness checks for Cisco Talos Intelligence for Enterprise Security Cloud (Splunk_TA_Talos_Intelligence, Splunkbase 7557).

This is not a normal polling input add-on. The package provides:

• a custom /query_reputation REST handler
• get_talos_enrichment capability
• adaptive response actions for collection and enrichment
• an encrypted Talos service account certificate/private-key stanza
• a disabled Talos IP blacklist threatlist

Package Verification Boundary

This skill's package-derived capability, REST-handler, and alert-action model was verified against 1.0.3, the current public release, which advertises Splunk 10.5. The package was downloaded, unpacked, and inspected here, so the shared installer's default pin needs no review override. Still repeat the capability, action, configuration-stanza, and threatlist-state checks against the live stack before declaring readiness.

Support Posture

Treat this as ES Cloud-first. Splunk documents the app for supported Splunk Enterprise Security Cloud deployments, ES 7.3.2+, and non-FedRAMP environments.

Do not ask the user for the Talos service account certificate/private key in chat. Splunk Cloud normally provisions the service account material; this skill validates its presence and fingerprint.

Workflow

Install and create the optional collection index:

bash skills/cisco-talos-intelligence-setup/scripts/setup.sh --install

Validate readiness:

bash skills/cisco-talos-intelligence-setup/scripts/validate.sh --completion

Only use file-based service account injection for explicit diagnostics:

bash skills/shared/scripts/write_secret_file.sh /tmp/talos_service_account.pem
bash skills/cisco-talos-intelligence-setup/scripts/configure_service_account.sh \
  --service-account-file /tmp/talos_service_account.pem

The IP blacklist threatlist stays disabled unless the user explicitly enables it.

Validation Modes

Run scripts/validate.sh for readiness diagnostics. Use --completion (alias --strict) to require the provisioned Talos service-account stanza and fingerprint in addition to the required ES app, capabilities, and alert actions. Talos provides ES enrichment actions rather than standalone dashboards or a continuously enabled event input.