Create query to lookup multiple indexes

[Yadukrishnan]

Hi,

Is it possible to make use of multiple indexes in one query. Below is the use case which I am trying to implement. 

If the connection from a IP address has a threat signature match in IPS, then look for the same address in WAF and if the WAF action is alerted, then trigger the alert. If the WAF action is blocked, then the alert can be suppressed. 

Is it possible to implement this use case. I am just trying to fine tune our detection capabilities as much as possible. 

[gcusello · Accepted solution]

Hi @Yadukrishnan,

yes you can search something in many indexes, the only attention is that you have to know which are the key fields: e.g if you have a field called IP in both indexes and a lookup containing the threat signatures in a column called IP, you could run something like this:

(index=ips [ | inputlookup threat_signatres.csv | fields IP ]) OR index=waf
| stats dc(indexes) AS dc_indexes values(indexes) AS indexs BY IP
| where dc_indexes=2

in few words, you have to create in the main search both the search conditions united by the OR condition, then grouping results by the common field you have to check if the field in in both the indexes.

you could also use the second search as subsearch but this solution has the limit of 50,000 results for the subsearch:

index=ips [ | inputlookup threat_signatres.csv | fields IP ] [ search index=waf | fields IP ]
| ...

 for this reason I always prefer the first solution.

Ciao.

Giuseppe