Hello, I am fairly new to Graylog and I am trying to get the Threat Intelligence Plugin to analyze the SRC section of such messages: ubnt kernel: [WAN_LOCAL-default-D]IN=eth0 OUT= MAC=REDACTED SRC=185.191.34.207 DST=REDACTED LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=16557 PROTO=TCP SPT=59574 DPT=7845 W…

Threat Intelligence Plugin Rules

gsmith (GSmith) January 5, 2022, 2:30am 4

Hello,

You have Graylog version 4.2 installed I assume.
If this is correct, then you may want to look at these post.

Topic		Replies	Views
Not able to understand Threat Intelligence plugin Graylog Central (peer support) pipeline-rules	4	2252	May 16, 2018
Create a new pipeline for Threat Intel Graylog Central (peer support) pipeline-rules	3	406	July 20, 2022
Graylog Threat Intel Plugin Results - Stuck in Tail cave Graylog Central (peer support) pipeline-rules	6	1619	June 29, 2020
Trying to get the Open Threat Exchange - Threat intel plugin working on a Graylog Graylog Central (peer support) pipeline-rules	10	1223	June 25, 2021
Vulnerability Scan Detection Graylog Central (peer support) pipeline-rules	10	662	July 14, 2022