Hello all,
I am working in Splunk ES and i would like to add the capability of getting a match on my URL list.
I have a lookup table that i add malicious URLs in it and I collect it from many different sources. I know Splunk ES has the Threat Intel for URLs but that does not work correctly. It only matches if the URL that I have with the look up table is a 100 percent match with the URL in the data model.
is there a way that i can tell Splunk ES to do a tstats and match the value from the lookup table even if it's only 80 percent of it?
Example:
let say i have abcd.com in the lookup table and in the data model under url field it show as abcd.com/ and just because of the "/" it would not match.
Thanks, looking forward to getting some sort of feed back.
