My question is in regards to the KVs in splunk ES.
Since i am not a admin just a user, I have uploaded few Look up tables and outputting them into the local_http_ip or local_ip_intel file. I am able to do that successfully. Now my question is does http_intel or ip_intel suppose to automatically pull that information from the local csv? IF so, then how often is supposed to do that.
Also, I have found another way of uploading my csv by configure>data enrich> Threat intel uploads. It get uploaded to he KV store and i can see event being generated in threat intel activity platfom but the issue with that it does not provide to much content about the IOCs. where in the csv i have information about the IOC.
Does anyone know a better way of doing this?
