How fresh is the data?

The feed refreshes every 15 minutes and the integration polls on the same cadence. Each poll only fetches indicators that changed since the last one, so steady state runs stay lightweight.

What indicator types are in the feed?

IPv4 addresses today. IPv6 is planned.

How long do indicators stay active?

Indicators expire 90 days after their last seen timestamp by default. You can change this with the IOC Expiration Duration setting.

Where do the Speculus specific fields go?

Standard fields map to ECS threat.indicator.*. Everything else, including the x_speculus_* extension properties, is namespaced under ti_speculus_taxii.stix.*.

No data is showing up. What do I check?

Verify the API key is active, then confirm the base URL and collection ID are reachable. Check the Elastic Agent logs: a 401 or 403 means an invalid or expired key, a timeout points to network or proxy issues.

Some documents failed to ingest. How do I find out why?

Check the failure store for the data stream and look at error.message. The raw document is preserved in event.original if you need to inspect it.

I'm behind a proxy or need custom TLS. Is that supported?

Yes. Set Proxy URL and SSL Configuration in the integration settings.

Speculus Threat Intelligence for Elastic

Each indicator carries a risk score, observed activity, named attribution where known, and network context such as geolocation, ISP and ASN, cloud provider, residential proxy, scanner, and Tor classifications.

What you can do with it

Enrich alerts in Elastic Security with STIX threat indicators.
Get alerts based on indicator match detection rules.
Visualize threats with our out-of-the-box dashboards.

How it works

The Elastic Agent polls the Speculus TAXII collection on a fixed interval. Each poll requests only the indicators that changed since the last one and pages through the results using the TAXII cursor. Every STIX object is then parsed by an ingest pipeline that maps its fields to ECS threat.indicator.*. Fields that have no ECS equivalent, including the Speculus x_speculus_* extension properties, are preserved under the ti_speculus_taxii.stix.* namespace so nothing is lost.

Requirements

Elastic Stack 8.18.0 or later, on Elastic Cloud or your own infrastructure.
An Elastic Agent enrolled in Fleet. Agentless deployment is also supported.
A Speculus account with TAXII access and an API key. Reach out to [email protected] if you need one.

Installation

In Kibana, go to Management > Integrations and search for “Speculus Threat Intelligence”.
Click Add Speculus Threat Intelligence.
Paste your Speculus API key. It is stored as a secret and masked in the UI.
Leave the remaining settings at their defaults unless Speculus has given you a different base URL or collection ID.
Click Save and continue.

That’s it. The defaults poll the feed every 15 minutes and pull 30 days of history on first start.

Configuration reference

Setting	Default	Description
Speculus TAXII Base URL	`https://feed.speculus.co`	Change only if Speculus provides a different host.
Collection ID	`speculus-ioc-feed`	Change only if Speculus provides a different collection.
API Key	none	Your Speculus API key, sent as a Bearer token.
Interval	`15m`	Time between polls. Matches the feed refresh cadence.
Initial Interval	`720h`	How far back to look on first start (30 days).
IOC Expiration Duration	`90d`	How long indicators remain valid after their last seen timestamp.
Limit	`1000`	Max STIX objects per TAXII request.
Proxy URL	none	Optional. Connect through a proxy.
SSL Configuration	none	Optional. Custom TLS settings.

Verify it works

In Kibana, open Discover and select the logs-ti_speculus_taxii.indicator-* data view.
Documents should appear within 15 minutes, with threat.indicator.ip and threat.indicator.confidence populated.

Data reference

The integration ships a single data stream, indicator, written to logs-ti_speculus_taxii.indicator-*. The feed consists of IPv4 indicators, with IPv6 planned.

Fields we bring in

Field	Description
`threat.indicator.ip`	The IP address.
`threat.indicator.name`	The indicator name.
`threat.indicator.description`	Observed activity and context for the indicator.
`threat.indicator.confidence`	Confidence level derived from the Speculus risk score.
`threat.indicator.first_seen`	When the indicator was first observed.
`threat.indicator.last_seen`	When the indicator was last observed.
`threat.indicator.geo.location`	Latitude and longitude of the IP.
`threat.indicator.geo.country_iso_code`	Country of the IP.
`threat.indicator.as.number`	ASN of the IP.
`threat.indicator.as.organization.name`	Organization or ISP behind the IP.
`tags`	Activity and attribution tags.
`ti_speculus_taxii.stix.*`	Additional Speculus context, including cloud provider, residential proxy, scanner, and Tor classifications.

Confidence levels

The Speculus risk score of 0 to 100 maps to threat.indicator.confidence:

Speculus Risk Score	Confidence
0	None
1 to 25	Low
26 to 49	Medium
50 to 100	High

Links

Questions? Email us at [email protected].

←Back to all integrations