Archive

UC_tor_traffic

New Member

Hey guys,

Is there any way how splunk get this lookup update itself or do we need to manually feed it? if yes what is the way around. Thanks

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

You need to provide more details. What app, what version of splunk, why are you updating it, how do you want to update it...?

0 Karma

New Member

Thanks,

I am using Splunk Security Essential App here, the rule comes as part of this app named: Basic TOR Traffic Detection

Here is the SPL being called

inputlookup UC_tor_traffic
| search app=tor src_ip=*
| table _time src_ip src_port dest_ip dest_port bytes app

When i checked the content of lookup: UC_tor_traffic, it shows the old data having dates of 2017, may be the dummy one. Curious about how to update this table and what is the way around.

Thanks in advance

0 Karma