Try this index=fda_sec_suricata sourcetype=suricata (src_ip!=10.X.X.X/X AND src_ip!=172.X.X.X/X AND src_ip!=192.X.X.X/X) (host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X" OR host="10.X.X.X") [| inputlookup YourLookup.csv | table host_ip | rename host_ip as dest_ip ] | eval CVE_listed=if(isnotnull(reference_cve) OR like(signature,"%CVE"),1,0) | rex field=signature "CVE-(?\d+-\d+)" | eval reference_cve="CVE-".reference_cve | search (CVE_listed=1) | dedup reference_cve, src_ip, src_port, dest_ip, dest_port | table category, signature, severity, reference_cve, reference_url, src_ip, src_port, dest_dns, dest_nt_host, dest_ip, dest_port, _time ... View more

Thank you! That worked. ... View more