i have a scripted lookup which is working fine. i configured in the lookups that the field name is called clientip for lookups.
now i want to make it more dynamic so that the lookup can also be used for other fields containing an ip address. those fields might be clientip, srcip, sourceip, dstip, destip and so on.
currently i found only that i need to configure one lookup command for each field name or rename the field in a pre command.
i want to make my app ip reputation more generic. so that someone can type
... | lookup threatscore src_ip
as well as
... | lookup threatscore clientip
or other field names depending what's required.
Thanks a lot
You could do the one lookup then just add "AS" so " | lookup threatscore ip AS srcip" That will map the srcip to the ip field from your lookup as you do it.
View solution in original post
great this is working - so easy 😉 thanks a lot