In ES 6.6.x and higher, what is the meaning of "Parse Domain from URL" under the Global Setting of Threat Intelligence Management?  Does it try to parse the domain from the URL which are the IOCs/threat artifacts, thus creating more domain IOCs, or is it trying to parse the logs (or Web.url where the events are) to get the domain? I know that in the older version, the "Threat Gen" searches would search for domain IOCs in the Web.url field, but I don't think the new version is doing that anymore. ... View more

I set up an Intelligence Download for https://threatfox-api.abuse.ch/api/v1  to use with the POST argument. However I am constantly getting the error:  Caught HTTPError when querying https://threatfox-api.abuse.ch/api/v1: code=405 exc=HTTP Error 405: Method Not Allowed I also see the log line: file=threatlist.py:download_csv:333 | status="CSV download starting" However this url does not return a csv. It will return a json and I am planning to use (?ms) in the extract regex to parse it. Is ES thinking that this is a csv and doing a GET instead of a POST? How do I control that? I have in the UI set the POST argument to be a json string required by the API. I am able to run curl and retrieve the output from this url. ... View more

I am using the multireport command to help manage some external lookup and caching. When I use one multireport command, it works fine: | makeresults | eval tmp="abc123.test|edf1234.test|abcdefg1234567890.test" | eval tmp2=split(tmp,"|") | mvexpand tmp2 | fields - tmp | rename tmp2 as mydomain | eval len=len(mydomain) | multireport [|where len<20 | eval isLess20="True"] [|where len>=20 | eval whatever="whatever"] When I try to use another multireport within one of the subqueries in the first multireport, I get "No results found". | makeresults | eval tmp="abc123.test|edf1234.test|abcdefg1234567890.test" | eval tmp2=split(tmp,"|") | mvexpand tmp2 | fields - tmp | rename tmp2 as mydomain | eval len=len(mydomain) | multireport [|where len<20 | eval isLess20="True"] [|where len>=20 | eval whatever="whatever" | multireport [| table len mydomain whatever ] [| table _time len] ] The example above has been simplified to illustrate the issue. But my real-world situation is this: before the 1st multireport command, I check against a lookup cache. If the cache has a match, show that set of results (this is the 1st subquery of the 1st multireport). If the cache has no match (2nd subquery of the 1st multireport), then perform a custom command to retrieve the data, then save to the cache and display the results. However, the list of fields to save to the cache is different than that to display, so I want to use another multireport to fork two branches -- one for saving a list of fields to the cache, and another to display a slightly different set of fields to the user. ... View more