Skip to content
LogScale Self-Hosted Deployment
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

## IOC Configuration

LogScale includes an IOC (Indicator of Compromise) database from CrowdStrike to enable lookup of IP addresses, URLs and domains for malicious activity using the `ioc:lookup()` query function.

This service is controlled with the configuration variable `ENABLE_IOC_SERVICE`, which is set to `true` (service on) by default.

- The database is updated hourly. If the database cannot be updated, any calls to `ioc:lookup()` will cause a warning in the query, but still add (potentially outdated) information.

- By default, the database is automatically updated using an update service hosted by LogScale, if the cluster is running with a valid LogScale license. If the LogScale license becomes invalid, the IOC database will be deleted and any calls to `ioc:lookup()` will fail.

- The location of the update server is configured by the `IOC_UPDATE_SERVER_URL` environment variable.

- The usage of HTTP proxy can be set using the `IOC_USE_HTTP_PROXY` environment variable.

- If you have an API key for the CrowdStrike Intel API yourself, you can update the IOC database directly from the CrowdStrike API, instead of using the update service. To do so, the token needs to have read access to Indicators (Falcon Intelligence) (ensure the relevant Read box in the API scopes is checked). Also, the variables below must be set as follows:

  - `IOC_CROWDSTRIKE_API_URL` to the url of the CrowdStrike API

  - `IOC_CROWDSTRIKE_API_CLIENT_ID` to the client ID of your CrowdStrike API key

  - `IOC_CROWDSTRIKE_API_CLIENT_SECRET` to the client secret of your CrowdStrike API key

#### Enter search term