Hi @jhooper33 , don't use the search command: put all the search terms in the main search, so you'll have a faster search: index=pan_logs [ inputlookup url_intel.csv | fields ioc | rename ioc AS de...
See more...
Hi @jhooper33 , don't use the search command: put all the search terms in the main search, so you'll have a faster search: index=pan_logs [ inputlookup url_intel.csv | fields ioc | rename ioc AS dest_url] NOT [| inputlookup whitelist.csv WHERE category=website | fields ignoreitem | rename ignoreitem as query ] NOT ("drop" OR "denied" OR "deny" OR "reset" OR "block")
| eval
Sensor_Name="Customer",
Signature="URL Intel Hits",
user=if(isnull(user),"-",user),
src_ip=if(isnull(src_ip),"-",src_ip),
dest_ip=if(isnull(dest_ip),"-",dest_ip),
event_criticality="Medium"
| rename _raw AS Raw_Event
| table _time event_criticality Sensor_Name Signature user src_ip dest_ip Raw_Event Ciao. Giuseppe