- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-11-2024 03:27 AM
Hi Team,
we want to extract and check the IP reputation of IP's from a context data value which consists of 70k IP's from EDL and i just need 1000 IP's from that context value. Could you please assist us ..? please find the attachment
Cortex XSOAR
03-11-2024 03:44 PM
Hi @SOAR-ADMIN – I see you already have your list of IPs stored in the ${MatchRegex.results} context key. If you only need to get the first 1000 IPs from the list, you can use the out-of-the-box GetRange transformer on that context key to only get the specified range of values.
When doing large-volume indicator enrichment like this, it is a good idea to break the input data into batches, as you are planning to do, to avoid overloading your server. Make sure quiet mode is turned on and indicator extraction is turned off on the enrichment task.
03-11-2024 03:44 PM
Hi @SOAR-ADMIN – I see you already have your list of IPs stored in the ${MatchRegex.results} context key. If you only need to get the first 1000 IPs from the list, you can use the out-of-the-box GetRange transformer on that context key to only get the specified range of values.
When doing large-volume indicator enrichment like this, it is a good idea to break the input data into batches, as you are planning to do, to avoid overloading your server. Make sure quiet mode is turned on and indicator extraction is turned off on the enrichment task.
03-11-2024 11:04 PM
Thanks Asawyer for your Reply, Could you suggest some free Threat intel platform from marketplace to enrich those IP's additionally which command should be used to remove duplicate IP's from that list ...?
03-22-2024 03:38 PM
@SOAR-ADMIN You can filter the Marketplace on "Free Enricher" to find publicly available threat intel integrations.
To dedup a list, use the Unique transformer.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!