A transit SOC analyst has a rare destination domain and a file hash from last night's parking-meter malware. What is the right way to see whether those values appear on the ISAC indicator list already loaded as a lookup?
Select an answer to reveal the explanation.
Short Explanation
An ISAC list is just a lookup table wearing a threat-intel badge. Pipe dest and file_hash into lookup and Splunk stamps a match if last night's parking-meter indicators are on the list. Grouping a day's traffic or rewriting the URL does not magically consult that table.
Full Explanation
Threat-intel matching in Splunk analysis is performed with lookup against an indicator table already loaded for the SOC. For last night's parking-meter malware, the transit analyst should lookup dest and file_hash against the ISAC list so match fields attach when those IoCs are present, leaving the live telemetry available for follow-on investigation. That is the same mechanism used for domains, hashes, and other technical indicators once the table is in place. rex rewriting a domain into a URL path does not query threat intelligence; extraction is not enrichment. transaction with a 24-hour span groups events in time and does not classify destinations as malicious merely because they fall inside the window. Substituting makeresults for the live events skips the parking-meter telemetry that must be checked and never exercises the ISAC join on real fields. Exam caveat: lookup only finds indicators that exist in the table with matching key names and normalized values—case and type still matter. Operational check: seed or select one known ISAC domain and hash, run lookup on a sample parking-meter event containing them, confirm match fields populate, then rerun on the overnight sample set before escalating.