I have followed the doc on how to configure blocklists; however, I am running into an issue because my new blocklists are not downloading. Below are my settings for Blocklist and Correlation searches:
Blocklist Settings:
Name: ZeusTracker
File Name: ip_ZeusTracker.csv
Field: onblocklist (**note: this is the same value for all my blocklists)
Correlation Search Settings:
Search: | src_dest_tracker | lookup local=true ip_ZeusTracker_lookup src OUTPUTNEW src_ip as src_ZeusTracker_ip,src_is_ZeusTracker | lookup local=true ip_ZeusTracker_lookup dest OUTPUTNEW dest_ip as dest_ZeusTracker_ip,dest_is_ZeusTracker | search dest_is_ZeusTracker=true OR src_is_ZeusTracker=true | eval ZeusTracker_ip=if(dest_is_ZeusTracker=="true",dest_ZeusTracker_ip,ZeusTracker_ip) | eval ZeusTracker_ip=if(src_is_ZeusTracker=="true",src_ZeusTracker_ip,ZeusTracker_ip) | fields + sourcetype,src,dest,ZeusTracker_ip
Does anyone see anything wrong with my settings?
