Hi guys ,
I just install misp42 app in my splunk , and add misp instance to splunk , it work
But i want compare from : index=firewall srcip=10.x.x.x , it my log from firewall , so i want compare dstip with ip-dst from misp to detect unusual access activities , like when dstip=ip-dst : 152.67.251.30 , how can i search this , misp_instance=IP_Block field=value , i just try some search but it not work:
index=firewall srcip=10.x.x.x
| mispsearch misp_instance=IP_Block field=value
| search dstip=ip=dst
| table _time dstip ip-dst value action
It cant get ip-dst from misp instance ,
Can anyone help me with this OR can i get some solution to resolve this
Many thanks and Best regards !!
