Configuring Blocklist and Correlation Search

[cedarcrestonese]

I have followed the doc on how to configure blocklists; however, I am running into an issue because my new blocklists are not downloading. Below are my settings for Blocklist and Correlation searches:

Blocklist Settings:

Name: ZeusTracker

File Name: ip_ZeusTracker.csv

Field: onblocklist (**note: this is the same value for all my blocklists)

Correlation Search Settings:

Search: | src_dest_tracker | lookup local=true ip_ZeusTracker_lookup src OUTPUTNEW src_ip as src_ZeusTracker_ip,src_is_ZeusTracker | lookup local=true ip_ZeusTracker_lookup dest OUTPUTNEW dest_ip as dest_ZeusTracker_ip,dest_is_ZeusTracker | search dest_is_ZeusTracker=true OR src_is_ZeusTracker=true | eval ZeusTracker_ip=if(dest_is_ZeusTracker=="true",dest_ZeusTracker_ip,ZeusTracker_ip) | eval ZeusTracker_ip=if(src_is_ZeusTracker=="true",src_ZeusTracker_ip,ZeusTracker_ip) | fields + sourcetype,src,dest,ZeusTracker_ip

Does anyone see anything wrong with my settings?

[Adrian]

I have a similar setup and instructions here that could be of assistance:

deepimpact.io/blog/splunkandfreeopen-sourcethreatintelligencefeeds