I'm starting with ES Threat Intelligence and am wondering, how threat intel data is populated to the KV stores used in the correlation search "Threat Activity Detected".
As a simple example I manually added an entry to local_email_intel (which is of course enabled).
Now I'm expecting the email address to appear in the KV store threatintel_by_email, which is used in the threat matching search for email. But threatintel_by_email is still empty, although I waited for a while for background jobs. I can't find the entered email address in the Threat Artifacts dashboard as well.
What is my mistake here? What kind of background job do we need/wait for to make my entry available for threat detection?
Thanks in advance 🙂