remove custom csv file of threat intellignance

[riqbal47010]

hi

I uploaded custom csv file containing IP addresses.
Referring link "https://docs.splunk.com/Documentation/ES/latest/API/ThreatIntelligenceAPIreference". I have to remove data rows one by one.
there are 400 Ip's against that IP.

So I have to execute this command 400 times ?
PR there is some other way to remove these feeds from threat intelligance KV store.

[harsmarvania57]

Please refer this https://answers.splunk.com/answers/683921/how-do-i-remove-iocs-from-a-kv-store.html

[riqbal47010]

sorry still my problem not solved.

Still the "threat activity detected" is triggering against custom uploaded csv file.

However when I give below command
| inputlookup ip_intel | search threat_key="abc"

I am not seeing any feed datas when I do

and under threat activity dashboard I can see that the custom csv upload threat feed is still ative against
most active threat sources