Match IP from main search to an IP in lookup file and output only the events that match from the main search

[carldipace]

I have my main search below. I want to match ip's from my main search to the ip's in my lookup file and output only the events that match. The lookup file field for my ip's is "host_ip" and the field in my main search is "dest_ip".

index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X") |
eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" |
eval reference_cve="CVE-".reference_cve |
search (CVE_listed=1) |
dedup reference_cve, src_ip, src_port, dest_ip, dest_port |
table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time

[somesoni2]

Try this

index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X")  [| inputlookup YourLookup.csv | table host_ip | rename host_ip as dest_ip ]
| eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" 
| eval reference_cve="CVE-".reference_cve 
| search (CVE_listed=1) 
| dedup reference_cve, src_ip, src_port, dest_ip, dest_port 
| table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time