https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-an-IOC-get-removed-from-ip-intel-if-you-remove-it-from-the/m-p/495013#M8525 <P>Hi all,</P> <P>So I followed the guide here <A href="https://docs.splunk.com/Documentation/ES/4.5.1/User/Configureblocklists" target="_blank">https://docs.splunk.com/Documentation/ES/4.5.1/User/Configureblocklists</A> in order to upload a custom csv file with some IOCs in it, and created a new intelligence download referring to the lookup, with 'lookup://lookup_name'. </P> <P>My assumption was that this lookup is dynamic so when you remove an IOC from the original lookup, this gets reflected in the ip_intel and other collections as well once the threat searches are run. I tried this and the IOC still exists in the collection and threat searches still run against it. When I add an IOC to the lookup, this gets added to ip_intel as well so that's working as expected.</P> <P>Am I wrong in thinking that IOCs get removed from ip_intel and other collections when you remove an IOC from the original lookup? Is the only way to remove an IOC to re-write the ip_intel without the said IOC using 'outputlookup'? </P> <P>Thanks for all your help!</P> Wed, 30 Sep 2020 03:54:18 GMT cybersecrav 2020-09-30T03:54:18Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-an-IOC-get-removed-from-ip-intel-if-you-remove-it-from-the/m-p/495013#M8525 <P>Hi all,</P> <P>So I followed the guide here <A href="https://docs.splunk.com/Documentation/ES/4.5.1/User/Configureblocklists" target="_blank">https://docs.splunk.com/Documentation/ES/4.5.1/User/Configureblocklists</A> in order to upload a custom csv file with some IOCs in it, and created a new intelligence download referring to the lookup, with 'lookup://lookup_name'. </P> <P>My assumption was that this lookup is dynamic so when you remove an IOC from the original lookup, this gets reflected in the ip_intel and other collections as well once the threat searches are run. I tried this and the IOC still exists in the collection and threat searches still run against it. When I add an IOC to the lookup, this gets added to ip_intel as well so that's working as expected.</P> <P>Am I wrong in thinking that IOCs get removed from ip_intel and other collections when you remove an IOC from the original lookup? Is the only way to remove an IOC to re-write the ip_intel without the said IOC using 'outputlookup'? </P> <P>Thanks for all your help!</P> Wed, 30 Sep 2020 03:54:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Does-an-IOC-get-removed-from-ip-intel-if-you-remove-it-from-the/m-p/495013#M8525 cybersecrav 2020-09-30T03:54:18Z