@gcusello Apologies for the late response, got the ok to send the search today. The url_intel.csv is what has 66,317 lines. I just ran this alert and it didn't give this regex error, so it is intermittent when it will give an error at all. index=pan_logs [ inputlookup url_intel.csv | fields ioc | rename ioc AS dest_url] | search NOT [| inputlookup whitelist.csv | search category=website | fields ignoreitem | rename ignoreitem as query ] | search NOT ("drop" OR "denied" OR "deny" OR "reset" OR "block") | eval Sensor_Name="Customer", Signature="URL Intel Hits", user=if(isnull(user),"-",user), src_ip=if(isnull(src_ip),"-",src_ip),dest_ip=if(isnull(dest_ip),"-",dest_ip), event_criticality="Medium" | rename _raw AS Raw_Event | table _time,event_criticality,Sensor_Name,Signature,user,src_ip,dest_ip,Raw_Event
... View more
