hard20 pts · first answer countssiemsplunkspl
A subsearch that silently drops IOCs
The threatintel index holds 80,000 malicious domains, yet this search misses proxy hits for domains you know are in it. What is the likely cause?
index=proxy [ search index=threatintel | fields dest ]
Discussion 0
Join free to post in the discussion.
Related questions
- What stats count by does in SPLCybersecurity Analyst
- Grouping with summarize in KQLCybersecurity Analyst
- Why logs go to a SIEMCybersecurity Analyst
- Why normalise to a common schemaCybersecurity Analyst
- What a SIEM is forCybersecurity Analyst
- What a Splunk index isCybersecurity Analyst
- What sourcetype tells SplunkCybersecurity Analyst
- The Splunk Universal ForwarderCybersecurity Analyst