Splunk Enterprise Security

Help with Splunk Enterprise Security IP threat intelligence lookup

New Member

Hello Splunkers,

I want to create my own saved search in Splunk Enterprise Security working on IP threat intelligence lookup called:

ip_intel 
search command is : index="apacheSplunkES" | append [ inputlookup email_intel ]|where src_user=email

And the command doesn't return any result even though I'm sure that I have a malicious IP stored in my index.

Thank you

0 Karma

Path Finder

Load the Optive Threat intel app

then use

index=main dest_ip=*

| lookup local=1 all_dest_ips.csv dest_ip OUTPUT threat_list_name, dest_ip

| search threat_list_name=* | dedup dest_ip | eval dest_ip=mvindex(dest_ip,0)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!