Query using multiple lookups

[hl]

Hello, 

   Looking for a way to query network traffic and search for IP's that have remote connection software i.e. ms-rdp and compare those ip's to the CrrowdStrike_lookup and print out the nt_host of the user and dns of the user.  Everything works expect the CrowdStrike lookup. 

| tstats `security_content_summariesonly` count min(_time)
as firstTime max(_time) as lastTime  values(All_Traffic.dest_port)
as dest_port latest(All_Traffic.user) as user from datamodel=Network_Traffic
where sourcetype="pan:*" All_Traffic.action="allowed"
by All_Traffic.action All_Traffic.app All_Traffic.bytes
All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.src_port
All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port
All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version
All_Traffic.src All_Traffic.src_ip  All_Traffic.transport All_Traffic.user
All_Traffic.signature
All_Traffic.vendor_product
| `drop_dm_object_name("All_Traffic")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| lookup remote_access_software remote_appid AS app OUTPUT
isutility, description as signature, comment_reference as
desc, category
| lookup CrowdStrike_asset_lookup nt_host AS src OUTPUT dns as ip
| search isutility = True
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_traffic_filter`

[hl · Accepted solution]

I figured it out now , 

`|lookup CrowdStrike_asset_lookup ip AS src_ip OUTPUT nt_host, dns`

[richgalloway]

What is not working as expected regarding the Crowdstrike lookup?

Verify the src field exists in the results when the lookup is performed.  Also, verify the lookup table has an nt_host field.  Confirm both fields use the same format, including case (unless the lookup is defined as case-insensitive).