Hello everyone. I've been reading and reading and I can not get consistent results from anything I have tried. So hopefully someone can help me get this straight. I have a csv as follows:
Indicator Type, Indicator, Description
domain, google.com, stuff
hash, asdfasdfdf4a6sd54fa6sd4fa6sd4f6sd, stuff
file, test.exe, stuff
I am trying to conduct a search that uses the Indicator column to search for ANY instances of the indicator. For example, it should return not just google.com, but also mail.google.com, or google.com.net. Additionally, I want to search the entire log, not just a specific field for that value. Here is what kinda works:
index=myindex | lookup NamedDefinition Indicator as logField OUTPUT Indicator as IOC | search IOC=* | stats count by IOC
That last part doesn't really matter, so it can be fields or whatever. This command works SOMETIMES. Sometimes I get errors that the lookup doesn't exist.
However, when it does work, this only searches one field in a log for something that matches in the csv EXACTLY. I tried putting a wildcard in the value (i.e. *google.com) but did not work. I also do not have access to modify any configuration files. I have also seen this command:
index=myindex [|inputlookup NamedDefinition.csv | fields Indicator]
but that has never returned any results. I know there are results (I use google.com as a control domain as well). Any help would be extremely appreciated.
