inbound OR outbound communication pattern matched

[riqbal47010]

I copied the bad reputed IP address, Hashes and Domains from any.run/malware-trends/remote
now how can I find the results that matches bad reputed IP against any source or destination.

[gcusello]

Hi riqbal47010,
could you describe more your request?
I think that you're speaking about proxy logs, how do you ingested them?
Can you share an example of your proxy logs?

Anyway, if you have proxy logs in an index called proxy_index and you already extracted a field called ip_dest, you could insert the information you copied by any.run in a lookup called e.g. anyrun.csv that contain three fields (ip, hash, domain).
Then you can run something similat to this:

index=proxy_index ip_dest=* [ | inputlookup anyrun.csv | rename ip AS ip_dest | fields ip_dest ]
| ...

Ciao.
Giuseppe

[riqbal47010]

Hi gcusello,

the concept mostly based on "threat activity detected" rule. that any value matched either source or destination he should trigger. your query( i believe) is just one sided.

[gcusello]

Hi riqbal47010,
If you have to check two fields, you can use the same approach:

index=proxy_index ip_dest=* ([ | inputlookup anyrun.csv | rename ip AS ip_dest | fields ip_dest ] OR [ | inputlookup anyrun.csv | rename ip AS ip_source | fields ip_source ])
| ...

Ciao.
Giuseppe