Help with inputintelligence command?

[dm1]

Below is my spl

|from datamodel:"Threat_Intelligence".""Threat_Activity"
|dedup threat_match_field,threat_match_value
|search NOT
[|inputintelligence cisco_top_million_sites
|rename domain as threat_match_value
|table threat_match_value]

 Explanation: basically from any threat activity detected, I want to remove false positives domains detected by using the cisco_top_million_sites as a reference to exclude FP domains.

However, the part where domains in threat_match_value is compared to domains in cisco_top_million_sites  threat intel file, some domains are not getting excluded. Its mainly the content.dropboxapi.com domain which still appears in the results even though its in the threat intel file while other sub domains of the dropboxapi.com are excluded.

Can someone please help with fixing this ?

[bowesmana · Accepted solution]

Subsearches can only return max 10,000 results, so if inputintelligence is returning more rows than that, you will not restrict your main search correctly. You would probably have to use a lookup created from inputintelligence and do

| lookup file domain as threat_match_value OUTPUT domain as found
| where isnull(found)

[dm1]

Thanks alot!!!