Splunk Search

Help with inputintelligence command?

dm1
Contributor

Below is my spl

 

|from datamodel:"Threat_Intelligence".""Threat_Activity"
|dedup threat_match_field,threat_match_value
|search NOT
[|inputintelligence cisco_top_million_sites
|rename domain as threat_match_value
|table threat_match_value]

 

 Explanation: basically from any threat activity detected, I want to remove false positives domains detected by using the cisco_top_million_sites as a reference to exclude FP domains.

However, the part where domains in threat_match_value is compared to domains in cisco_top_million_sites  threat intel file, some domains are not getting excluded. Its mainly the content.dropboxapi.com domain which still appears in the results even though its in the threat intel file while other sub domains of the dropboxapi.com are excluded.

Can someone please help with fixing this ?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Subsearches can only return max 10,000 results, so if inputintelligence is returning more rows than that, you will not restrict your main search correctly. You would probably have to use a lookup created from inputintelligence and do

| lookup file domain as threat_match_value OUTPUT domain as found
| where isnull(found)

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Subsearches can only return max 10,000 results, so if inputintelligence is returning more rows than that, you will not restrict your main search correctly. You would probably have to use a lookup created from inputintelligence and do

| lookup file domain as threat_match_value OUTPUT domain as found
| where isnull(found)

dm1
Contributor

Thanks alot!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...