topic Re: Where i can update legit_domains.csv in Splunk Search

Where i can update legit_domains.csv

zksvc — Mon, 26 Aug 2024 03:34:09 GMT

Hi everyone i want to ask where can i get latest update for legit_domains.csv ?

Ask here because when i check it in lookup it says no owner, so i think it created automatically from Splunk.

I know it can be update it manually, but it takes time again. it will helpfull when you can give me latest update for this .csv

Re: Where i can update legit_domains.csv

gcusello — Mon, 26 Aug 2024 06:23:56 GMT

Hi @zksvc ,

this lookup belongs to the ES Content Updates App, so it should be updated when you update this app.

Ciao.

Giuseppe

Re: Where i can update legit_domains.csv

zksvc — Mon, 26 Aug 2024 09:46:52 GMT

Hi @gcusello Thanks for your reply when i check my "ES Content Updates" is version 4.0.0 and it available Update to 4.38.0 I have question if I update it, will it affect other use cases that have been enabled? Or will it be safe for other use cases?

Re: Where i can update legit_domains.csv

gcusello — Mon, 26 Aug 2024 10:11:17 GMT

Hi @zksvc ,

I don't know which use cases you enabled, but it's possible,

but anyway, app upgrade is a normal activity in ES.

Ciao.

Giuseppe

Re: Where i can update legit_domains.csv

zksvc — Mon, 26 Aug 2024 11:01:48 GMT

Okay if like that, but did splunk 9.1.5 Compatible with 4.38.0 ? sorry because it's not my personal enviroment that's why i'm so careful before take action.

Ciao.

Zake

Re: Where i can update legit_domains.csv

gcusello — Mon, 26 Aug 2024 12:58:44 GMT

Hi @zksvc ,

version 4.38.0 is compatible with Splunk 9.1.x, 9.2.x and 9.3.x versions.

Anyway, this app mainly gives you new Use Cases and eventual correct some old use cases, it's described in the documentation.

ciao.

Giuseppe

Re: Where i can update legit_domains.csv

zksvc — Tue, 27 Aug 2024 01:36:47 GMT

Thankyou for all information 🍻

Hope you have a nice day sir

Ciao.

Zake