A transit SOC analyst has a rare destination domain and a file hash…

Question

A transit SOC analyst has a rare destination domain and a file hash from last night's parking-meter malware. What is the right way to see whether those values appear on the ISAC indicator list already loaded as a lookup?

Accepted Answer

Use lookup on dest and filehash against the ISAC intel table to attach match fields. — An ISAC list is just a lookup table wearing a threat-intel badge. Pipe dest and filehash into lookup and Splunk stamps a match if last night's parking-meter indicators are on the list. Grouping a day's traffic or rewriting the URL does not magically consult that table.

Answer

Use rex to rewrite the domain into a URL path, which automatically queries threat intelligence.

Answer

Use transaction maxspan=24h so any domain in the window is treated as malicious.

Answer

Use makeresults in place of the live events so the ISAC list is never queried.

A transit SOC analyst has a rare destination domain and a file hash from last night's parking-meter malware. What is the right way to see whether those values appear on the ISAC indicator list already loaded as a lookup?

Short Explanation

Full Explanation