How to effectively retroactively hunt IOCs

[Anonymous]

I've been given a list of IOCs to go hunting on. I can obviously add those to feed/list to alert and generate meta if in the future they are seen, but what's the best way to take those IOCs (about 50 at this stage) and retroactively go back through stored data and search for them?

[drewjc]

Hi Jeremy,

In my experience the reporting engine is the only efficient way to perform historic searching like you are describing. Essentially you'd add your IOCs to a list in the reporting engine and then create your matching rule and develop/run a report. The alternative would be using the REST API and scripting out a search that incrementally searches previous chunks of time going as far back as you need. 

[Anonymous]

Thanks for your reply. I was thinking along the same lines. 

And in thinking about it, I suppose that if I wanted to bring something to light to action immediately, I could have the reporting engine generate it's output as meta and then an ESA alert on that. Unless I'm remembering the capabilities of the reporting engine incorrectly.

[drewjc]

Not sure if the reporting engine supports ESA notification based on generated reports, but at a minimum you could create a feed and ESA alert for matches of traffic being currently processed.