Splunk Enterprise Security

Help with Splunk Enterprise Security IP threat intelligence lookup

New Member

Hello Splunkers,

I want to create my own saved search in Splunk Enterprise Security working on IP threat intelligence lookup called:

search command is : index="apacheSplunkES" | append [ inputlookup email_intel ]|where src_user=email

And the command doesn't return any result even though I'm sure that I have a malicious IP stored in my index.

Thank you

0 Karma

Path Finder

Load the Optive Threat intel app

then use

index=main dest_ip=*

| lookup local=1 all_dest_ips.csv dest_ip OUTPUT threat_list_name, dest_ip

| search threat_list_name=* | dedup dest_ip | eval dest_ip=mvindex(dest_ip,0)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...