Explanation
"The Threat Intelligence Framework provides a modular input (Threat Intelligence Downloads) that handles the majority of configurations typically needed for downloading intelligence files & data. To access this modular input, you simply need to create a stanza in your Inputs.conf file called "threatlist"."

Explanation
The value in the red box is an IP address rating. This is a numerical value that represents the risk associated with an IP address. The higher the value, the higher the risk. This value is calculated based on the number of security events associated with the IP address, the severity of those events, and the time since the last event.
References:
Administering Splunk Enterprise Security
Splunk Enterprise security Admin
IP Intelligence

Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/ Customizemenubar#Restore_the_default_navigation