https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-threatlist-via-REST/m-p/181696#M844 <P>May be its quite old now, but found it in </P> <PRE><CODE>| rest /services/data/inputs/threatlist </CODE></PRE> Sat, 28 Oct 2017 12:29:38 GMT koshyk 2017-10-28T12:29:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-threatlist-via-REST/m-p/181694#M842 <P>Is there any way to view actual contents of a threatlist via REST? I've found references to:</P> <P>| rest /services/data/threatliststats</P> <P>and</P> <P>| rest /services/data/inputs/threatlist</P> <P>But these objects only show metadata about the threatlist. How do I get actual contents? The reason I need to do this is because my threatlist type is custom (i.e. not "threatlist" or "threatlist_domain") which means that the contents do not actually get put in the normal threatlist lookup tables such as threatlist_lookup_by_domain_or_url or threatlist_lookup_by_str.</P> <P>Thanks in advance for the help!</P> Mon, 28 Sep 2020 19:50:47 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-threatlist-via-REST/m-p/181694#M842 laleger 2020-09-28T19:50:47Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-threatlist-via-REST/m-p/181695#M843 <P>Try this search:</P> <P><CODE>| 'all_threat_intel' | fields ip,url,domain,threat_key</CODE></P> <P>That is the macro all_threat_intel, so enclose that term in back ticks ``</P> Tue, 29 Sep 2020 08:00:10 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-threatlist-via-REST/m-p/181695#M843 mcronkrite 2020-09-29T08:00:10Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-threatlist-via-REST/m-p/181696#M844 <P>May be its quite old now, but found it in </P> <PRE><CODE>| rest /services/data/inputs/threatlist </CODE></PRE> Sat, 28 Oct 2017 12:29:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-view-threatlist-via-REST/m-p/181696#M844 koshyk 2017-10-28T12:29:38Z