Splunk Search

Help with inputintelligence command?

dm1
Contributor

Below is my spl

 

|from datamodel:"Threat_Intelligence".""Threat_Activity"
|dedup threat_match_field,threat_match_value
|search NOT
[|inputintelligence cisco_top_million_sites
|rename domain as threat_match_value
|table threat_match_value]

 

 Explanation: basically from any threat activity detected, I want to remove false positives domains detected by using the cisco_top_million_sites as a reference to exclude FP domains.

However, the part where domains in threat_match_value is compared to domains in cisco_top_million_sites  threat intel file, some domains are not getting excluded. Its mainly the content.dropboxapi.com domain which still appears in the results even though its in the threat intel file while other sub domains of the dropboxapi.com are excluded.

Can someone please help with fixing this ?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Subsearches can only return max 10,000 results, so if inputintelligence is returning more rows than that, you will not restrict your main search correctly. You would probably have to use a lookup created from inputintelligence and do

| lookup file domain as threat_match_value OUTPUT domain as found
| where isnull(found)

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Subsearches can only return max 10,000 results, so if inputintelligence is returning more rows than that, you will not restrict your main search correctly. You would probably have to use a lookup created from inputintelligence and do

| lookup file domain as threat_match_value OUTPUT domain as found
| where isnull(found)

dm1
Contributor

Thanks alot!!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...