All Apps and Add-ons

Help to get the threat score lookup in IP Reputation app working?

New Member

Hello,

I installed the app and added the key in scorelookup.py.
What to do next ?
I tried a search "dstport 80 | rename srcip as clientip" and don't have the threatscore field.

Any idea ?

Txs

0 Karma

Communicator

you also need to define dst_port=80 with = that is Splunk common search syntax.

so tray:

dst_port=80 | lookup threatscore clientip as src_ip

no renaming required if you write "as src_ip"

br
Matthias

Path Finder

Tried adding an explicit lookup?

i.e. "dstport 80 | rename srcip as clientip | lookup threatscore clientip"

0 Karma

Explorer

the threatscore field isn't getting inserted into the data stream... How is this generated?

0 Karma