topic Re: help with inputintelligence command in Splunk Search

Help with inputintelligence command?

dm1 — Mon, 24 Oct 2022 13:16:25 GMT

Below is my spl

Explanation: basically from any threat activity detected, I want to remove false positives domains detected by using the cisco_top_million_sites as a reference to exclude FP domains.

However, the part where domains in threat_match_value is compared to domains in cisco_top_million_sites threat intel file, some domains are not getting excluded. Its mainly the content.dropboxapi.com domain which still appears in the results even though its in the threat intel file while other sub domains of the dropboxapi.com are excluded.

Can someone please help with fixing this ?

Re: help with inputintelligence command

bowesmana — Mon, 24 Oct 2022 00:50:54 GMT

Subsearches can only return max 10,000 results, so if inputintelligence is returning more rows than that, you will not restrict your main search correctly. You would probably have to use a lookup created from inputintelligence and do

| lookup file domain as threat_match_value OUTPUT domain as found | where isnull(found)

Re: help with inputintelligence command

dm1 — Mon, 24 Oct 2022 01:24:54 GMT

Thanks alot!!!