Use Lookup Table to search trough past data

[dmuensterer]

I have a lookup table (imported CSV) containing lots of Indicators of compromise in a format like this:
ioc_value,ioc_type
e8bf8789a98b009c98d98c98,md5
https://malicious.com,url

Is there any way to combine this lookup table with a search like this:
exists:url AND lookup(ioc_lookup, url)

I.e. I want to find all events where a certain field exists and if so I want to search through the lookup table.

This would be tremendously helpful to find past Zero-Day Exploits whose IOCs weren’t in the lookup table at the point when the incident happened.

[gsmith]

Hello,

This posts seams to be the same as this one…

Search through CSV Data adapter via Regex

1. Describe your incident: I am trying to create a data adapter whose values I can lookup by using a regex pattern. Let’s say I have values like this in my CSV: url,status https://attacker-ip.com/1234,online http://malicious-address.br/abc,online Is there a way to search through the data adapter by using a regex like e.g. .malicious-address.br.

Yeah you can do that, it also depends on the type of data adapter your using.

[dmuensterer]

Thanks but that is not what I meant.
I want to match every event with a condition against my lookup table. But perhaps that is something one could combine.
Let me describe it more in detail in the other thread.