i have a scripted lookup which is working fine. i configured in the lookups that the field name is called clientip for lookups.
now i want to make it more dynamic so that the lookup can also be used for other fields containing an ip address. those fields might be clientip, src_ip, source_ip, dst_ip, dest_ip and so on.
currently i found only that i need to configure one lookup command for each field name or rename the field in a pre command.
i want to make my app ip reputation more generic. so that someone can type
... | lookup threatscore src_ip
as well as
... | lookup threatscore clientip
or other field names depending what's required.
Thanks a lot
You could do the one lookup then just add "AS" so " | lookup threatscore ip AS src_ip" That will map the src_ip to the ip field from your lookup as you do it.
View solution in original post
great this is working - so easy 😉 thanks a lot