UC_tor_traffic

[pavanbmishra]

Hey guys,

Is there any way how splunk get this lookup update itself or do we need to manually feed it? if yes what is the way around. Thanks

[jkat54]

You need to provide more details. What app, what version of splunk, why are you updating it, how do you want to update it...?

[pavanbmishra]

Thanks,

I am using Splunk Security Essential App here, the rule comes as part of this app named: Basic TOR Traffic Detection

Here is the SPL being called

inputlookup UC_tor_traffic
| search app=tor src_ip=*
| table _time src_ip src_port dest_ip dest_port bytes app

When i checked the content of lookup: UC_tor_traffic, it shows the old data having dates of 2017, may be the dummy one. Curious about how to update this table and what is the way around.

Thanks in advance