If you look at the configuration for "Threat - Source And Destination Matches - Threat Gen" in savedsearches.conf, you should be able to see this "action.threat_activity=1" which is a reference to “alert_actions.conf” in DA-ESS-ThreatIntelligence app which has [threat_activity] stanza. It is a reference to call that alert action If you look at this stanza in alert_actions.conf, you can see that it is "summaryindex" ing to threat_activity index (highlighted) Please note "summaryindex" is an alias to "collect" command. The part where summaryindex command is present in "threat_activity" alert action is given below. | summaryindex spool=t uselb=t addtime=t index="$action.threat_activity._name{required=yes}$" ... View more

Thanks! It works. ... View more