First of all many thanks for this tool,
It has really help me to make the interconnection between MISP and Splunk,
I was wondering if is there any reason why you changed the savedsearch query when dealing with different lookup table (KvStore Lookup and csv Lookup) ?
Hello,
First of all many thanks for this tool, It has really help me to make the interconnection between MISP and Splunk,
I was wondering if is there any reason why you changed the savedsearch query when dealing with different lookup table (KvStore Lookup and csv Lookup) ?
Is there any performance issue that you want to address here ? (CSV lookup Vs KvStore lookup)
For example in savedsearch.conf the email related saved search that feed the KvStore lookup is:
But the email related saved search that feed the CSV lookup is not the same:
Is it made for purpose ? or it's just to show another way to get some email_lookup (to avoid repeating something that already exist) ?