Threat intelligence IPs/URL to be searched against...

pdafale_lgiasup · ‎01-16-2020

I am working on a specific requirement where outgoing proxy connections towards Threat list IPs/URLs need to be alerted. I need to to map dest_ip and url fields to Threat lists.
Can someone please help me with the query for the same.

Regards,
Prathamesh

to4kawa · ‎01-16-2020

hi, @pdafale_lgiasuper
Is Threat list IPs/URLs CSV? what's column and detail?

Threat intelligence IPs/URL to be searched against poxy logs

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Are you a member of the Splunk Community?

Threat intelligence IPs/URL to be searched against poxy logs

Aligning Observability Costs with Business Value: Practical Strategies

Mastering Data Pipelines: Unlocking Value with Splunk

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0