Enterprise Security Threat Intelligence - Lookup population?

[HeinzWaescher]

Hi,

I'm starting with ES Threat Intelligence and am wondering, how threat intel data is populated to the KV stores used in the correlation search "Threat Activity Detected".

As a simple example I manually added an entry to local_email_intel (which is of course enabled).
Now I'm expecting the email address to appear in the KV store threatintel_by_email, which is used in the threat matching search for email. But threatintel_by_email is still empty, although I waited for a while for background jobs. I can't find the entered email address in the Threat Artifacts dashboard as well.

What is my mistake here? What kind of background job do we need/wait for to make my entry available for threat detection?

Thanks in advance 🙂

[HeinzWaescher]

It looks like disabling and re-enabling the local_email_intel source via the management interface does the trick. But I don't think this should be the way to go 🙂