Splunk Search

How to search custom IOC file

VR1225
New Member

Hi All,

I'm new to Splunk.  I'm not much familiar with the query search and lookup files. I have a custom IOC file with IPs & URLs and I want to search if there was any traffic to that destination. I went through few of the blogs and the suggestion was to create a csv lookup file. 

Could you please let me know if it is the correct approach or is there any better way to search the IOCs?

Labels (3)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!