https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491051#M8337 <P>Hi,</P> <P>Please try below query</P> <PRE><CODE>index=reverse_proxy | lookup ip_intel ip as src OUTPUT threat_key | where isnotnull(threat_key) </CODE></PRE> Tue, 05 May 2020 11:33:34 GMT harsmarvania57 2020-05-05T11:33:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491049#M8335 <P>Hi,</P> <P>Does anyone know if there is an efficient way to incorporate ip_intel into a search/query. I want to set up an alert using a particular ip_intel feed for a specific index to notify me when there is traffic from high-risk IP addresses.</P> <P>Currently trying the below but I get no results (saw the below as another answer but cannot get it to work)</P> <P>index=reverse_proxy [|inputlookup ip_intel | return ip] | where ip=src </P> <P>note: "src" is the the field name in which the IP is parsed for my index</P> <P>Cheers</P> Wed, 30 Sep 2020 05:18:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491049#M8335 hbfblueteam 2020-09-30T05:18:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491050#M8336 <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Return</A></P> <PRE><CODE>&lt;count&gt; Syntax: &lt;int&gt; Description: Specify the number of rows. Default: 1, which is the first row of results passed into the command. </CODE></PRE> <P>see reference.</P> Tue, 05 May 2020 05:22:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491050#M8336 to4kawa 2020-05-05T05:22:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491051#M8337 <P>Hi,</P> <P>Please try below query</P> <PRE><CODE>index=reverse_proxy | lookup ip_intel ip as src OUTPUT threat_key | where isnotnull(threat_key) </CODE></PRE> Tue, 05 May 2020 11:33:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491051#M8337 harsmarvania57 2020-05-05T11:33:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491052#M8338 <P>Thank you, that has given me some results</P> <P>Regards,<BR /> Marko</P> Wed, 06 May 2020 00:48:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/searching-and-alerting-on-ip-intel/m-p/491052#M8338 hbfblueteam 2020-05-06T00:48:33Z