Hi, I'm starting with ES Threat Intelligence and am wondering, how threat intel data is populated to the KV stores used in the correlation search "Threat Activity Detected". As a simple example I manually added an entry to local_email_intel (which is of course enabled). Now I'm expecting the email address to appear in the KV store threatintel_by_email, which is used in the threat matching search for email. But threatintel_by_email is still empty, although I waited for a while for background jobs. I can't find the entered email address in the Threat Artifacts dashboard as well. What is my mistake here? What kind of background job do we need/wait for to make my entry available for threat detection? Thanks in advance 🙂   ... View more

Hi, I'm not sure about the effect of the general setting "Save results to KVStore / index". Is there a difference in the functionality/features of the alert handling depending on this setting? Can I just activate one or the other? What if I activate both? Best regards 🙂 ... View more

Hi, when I run a dashboard search, I'm writing an event to an index=test with the collect command. When this search is finished, it sets a token which is used to start a second search. This second is visualizing events from the index=test and should show the latest collected event when it runs. Basically it works, but sometimes the seconds search does not recognize the latest event from index=test. I assume the second search starts to close after the collect command. Is it possible to create some kind of delay between these searches? Or is there another approach to solve this problem? What I could think of, is to append a random append for internal data after the collect command, and remove this results directly afterwards. Just to create a longer duration of the search, so that the trigger for second search is set some seconds later. Thanks in advance ... View more

Hi, I would like to know whether it is possible to perform something like this per default for each and every search in the background: | eval _raw=split(_raw, user) | eval user_hash=sha256(user) | eval _raw=mvjoin(_raw, user_hash) Thanks in advance ... View more