Dynamic field-names for lookups

[Matthias_BY]

Hello,

i have a scripted lookup which is working fine. i configured in the lookups that the field name is called clientip for lookups.

now i want to make it more dynamic so that the lookup can also be used for other fields containing an ip address. those fields might be clientip, src_ip, source_ip, dst_ip, dest_ip and so on.

currently i found only that i need to configure one lookup command for each field name or rename the field in a pre command.

i want to make my app ip reputation more generic. so that someone can type

... | lookup threatscore src_ip

as well as

... | lookup threatscore clientip

or other field names depending what's required.

Thanks a lot
Matthias

[starcher · Accepted solution]

You could do the one lookup then just add "AS" so " | lookup threatscore ip AS src_ip" That will map the src_ip to the ip field from your lookup as you do it.

[Matthias_BY]

great this is working - so easy 😉 thanks a lot