I have included in my installation Sophos Virtual Email Appliance logs. The logs include the originating IP with field name "fur". Is there any way to map it as IP in order to get correlated with Enterprise Security app threat intelligence sources (e.g. if this IP is flagged by enterprise security, etc.)?
You're not looking for
map (this is a search command which should be only used as some sort of last resort).
You're looking for a field alias http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/Abouttagsandaliases
By using an alias of
fur you will able to use it in Enterprise Security.
Hope this helps ...
After this field alias, is there any extra work to be performed on the Enterprise security app?