How-To: Search for URL Indicators of Compromise (IoC) Across a Data Set
URLs are a typical IoC. With LogScale, it's easy to use LogScale Query
Language (LQL) to determine a possible threat using the
lookup()
function.
For example:
logscale
// Ensure the URL is written in all lowercase.
url := lower(YOUR URL)
// Perform the lookup for the URL. The strict option only returns matches.
| ioc:lookup(field=url, type=url, confidenceThreshold=unverified, strict=true)