REvil Kaseya IOCs for Splunk Ingest Collected from various feeds including Sophos (https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers), Cado Security (https://www.cadosecurity.com/post/resources-for-dfir-professionals-responding-to-the-revil-ransomware-kaseya-supply-chain-attack).
Instructions on how to add IOCs into Splunk Enterprise Security- https://www.splunk.com/en_us/blog/security/how-do-i-add-covid-threat-intelligence-from-the-internet-to-enterprise-security.html