How do I run my list of IOC from my lookup table against a web datamodel by using tstats.
I can do the regular IOC lookup table against the indexes and it work perfectly fine, however, it just take a lot of memory.
It would be help if some one knows how to run csv or kv to compare it with datamodel.
Try this!
|tstats count from datamodel=Web where [| inputlookup http_intel.csv | fields url | rename url as Web.url] by Web.url
Could you give an example what you're already doing, your data, your lookup, your expected output, etc?
for example here is a very basic search i am running
|tstats count from datamodel=Web by Web.url
| search
[| inputlookup http_intel
| fields url
| rename url as Web.url]