How-To: Search for URL Indicators of Compromise (IoC) Across a Data Set

URLs are a typical IoC. With LogScale, it's easy to use LogScale Query Language (LQL) to determine a possible threat using the lookup() function.

For example:

logscale
// Ensure the URL is written in all lowercase. 
url := lower(YOUR URL)
// Perform the lookup for the URL. The strict option only returns matches. 
| ioc:lookup(field=url, type=url, confidenceThreshold=unverified, strict=true)