Splunk stats+lookup

index=proxy | stats count by dest | lookup threat_intel dest

Cross-reference proxy traffic destinations with a threat intel lookup, detecting communications with known malicious domains or IPs.

Run it when you have proxy logs and a threat intel lookup (Abuse.ch's, one fed by your TIP, or a vendor's): the SPL groups traffic by destination and cross-references with the lookup — each destination matching an IOC pops as a finding. It's C2 and malware download detection via the corporate proxy: beaconing to a malicious domain or downloading a payload from a known IP is exposed. The lookup is the heart: keeping it updated (Abuse.ch URLhaus, or the org's TIP) decides detection quality.

Don't use it if the lookup isn't updated: months-old threat intel won't see today's C2s — the detection is only as good as the source, and stale lookups give a false sense of coverage. The join field (dest vs the lookup field) must match in format (domain, IP, URL): a silent mismatch returns zero results. And watch volume: index=proxy without a time window over weeks of logs is an expensive search; scope with earliest. An IP lookup only matches IPs: C2s with rotating domains (fast flux, DGA) require domain-based cross-referencing and DNS analysis.