Custom IOC feed report

[Mikael]

Hi all,

I'm trying to create a report in R81 for an environment with multiple external IOC feeds.

In the report I'd like a table that shows the number of logs peer feed.

As far as I can tell the information I need is stored in the "Indicator Name"-field (see screenshot) and this field isn't indexed.

There's similar information in the "Protection Name"-field but that also contains the observXXXX-information which isn't what I want.

Does anyone know If there is a way to create a report for a field that isn't indexed, or if I can add fields to the index?

Another option would be if I can filter the data from the indexed field "Protection Name" to build the chart based only on the first X characters.

Any ideas?

Cheers

[PhoneBoy]

That which is not indexed can’t have reports run against it.
It would require an RFE.

That said, R81.10 is just around the corner and won’t be using Solr any longer.
It'll be interesting to see if that also means more fields will be indexed/available for reports.

[Mikael]

Doesn't look promising based on the current R81.10 EA-client and the demo-environment...

Let's hope there are things to be done on the backend once it's released...

[PhoneBoy]

It appears I kind of got this wrong.
Solr is being removed, but only for certain management-related functions unrelated to logging.
Logging will still use Solr, with R81 seeing a huge improvement due to an upgraded version.