topic Re: Threat Intel module mapping multiple fields to same variable in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Threat-Intel-module-mapping-multiple-fields-to-same-variable/m-p/541015#M9726 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/85678">@avivn</a>,</P><P>You can add the same threat intel source twice by selecting different field as var.</P><P>&nbsp;</P> Tue, 23 Feb 2021 14:08:08 GMT scelikok 2021-02-23T14:08:08Z Threat Intel module mapping multiple fields to same variable https://community.splunk.com/t5/Splunk-Enterprise-Security/Threat-Intel-module-mapping-multiple-fields-to-same-variable/m-p/541004#M9725 <P>Hi,</P><P>In threat intel module when adding a new threat feed source,</P><P>The feed contains also sha-256 and MD5 but I can map only one of them to the file_hash var,</P><P>There is an option to map multiple fields into the same var?</P> Tue, 23 Feb 2021 12:21:45 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Threat-Intel-module-mapping-multiple-fields-to-same-variable/m-p/541004#M9725 avivn 2021-02-23T12:21:45Z Re: Threat Intel module mapping multiple fields to same variable https://community.splunk.com/t5/Splunk-Enterprise-Security/Threat-Intel-module-mapping-multiple-fields-to-same-variable/m-p/541015#M9726 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/85678">@avivn</a>,</P><P>You can add the same threat intel source twice by selecting different field as var.</P><P>&nbsp;</P> Tue, 23 Feb 2021 14:08:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Threat-Intel-module-mapping-multiple-fields-to-same-variable/m-p/541015#M9726 scelikok 2021-02-23T14:08:08Z