# Threat Intelligence Plugin Help

**URL:** <https://community.graylog.org/t/threat-intelligence-plugin-help/19881>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [May 18, 2021, 1:22pm UTC](https://community.graylog.org/t/threat-intelligence-plugin-help/19881 "2021-05-18T13:22:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stevewaha](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/stevewaha/32/8515_2.png) [@stevewaha](https://community.graylog.org/u/stevewaha)\
**Post date:** [May 18, 2021, 1:22pm UTC](https://community.graylog.org/t/threat-intelligence-plugin-help/19881/1 "2021-05-18T13:22:32Z")

</div>

Hey All  
I’m trying to get the Open Threat Exchange - Threat intel plugin working on a graylog instance in my lab. I have installed the Content pack and added a a pipeline to a Squid Proxy stream to try to get some basic threat analysis on the field “\_server\_ip” … but it will not add fields to the stream. Below is my pipeline rule …

* * *

rule “Spamhaus Lookup”  
when  
has\_field("\_server\_ip")  
then  
let intel = otx\_lookup\_ip(to\_string($message.\_server\_ip));  
set\_field(“threat\_indicated”, intel.otx\_threat\_indicated);  
set\_field(“threat\_ids”, intel.otx\_threat\_ids);  
set\_field(“threat\_names”, intel.otx\_threat\_names);  
end

* * *

The simulator works ok and looks up the IP but it will not enter anything in the stream.  
Can anyone help.  
Cheers  
Steve

---

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [May 27, 2021, 2:13pm UTC](https://community.graylog.org/t/threat-intelligence-plugin-help/19881/2 "2021-05-27T14:13:50Z")

</div>

2 posts were merged into an existing topic: [About the Daily Challenges category](https://community.graylog.org/t/about-the-daily-challenges-category/19990)

---

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [May 27, 2021, 2:13pm UTC](https://community.graylog.org/t/threat-intelligence-plugin-help/19881/3 "2021-05-27T14:13:50Z")

</div>