# Automatically Updating the Blacklisted IP on a daily basis **URL:** \ **Category:** Logstash\ **Created:** [February 17, 2016, 10:20am UTC](https://discuss.elastic.co/t/automatically-updating-the-blacklisted-ip-on-a-daily-basis/42000 "2016-02-17T10:20:16Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\ **Post date:** [February 17, 2016, 10:20am UTC](https://discuss.elastic.co/t/automatically-updating-the-blacklisted-ip-on-a-daily-basis/42000/1 "2016-02-17T10:20:16Z")
Hello, We are building a rule "Sucessful Connection to Blacklisted IP". We are doing this using translate filter. We are taking the Blacklisted IPs from SANS or other security websites. Is their any way to automatically update the list on a daily basis or is their any way where the ELK can connect to the SANS Database/Website and auto update the blacklisted IP sheet on a daily basis. Help would be appreciated. Thanks /Praveen ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 20, 2016, 7:34pm UTC](https://discuss.elastic.co/t/automatically-updating-the-blacklisted-ip-on-a-daily-basis/42000/2 "2016-02-20T19:34:27Z")
If you're already using a translate filter it sounds like you just need a cronjob that pulls fresh data from the sources and stores in the YAML file. Building such functionality into Logstash seems highly unnecessary. ---
**Author:** ![praveen\_siem](https://avatars.discourse-cdn.com/v4/letter/p/e9a140/32.png) [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\ **Post date:** [February 22, 2016, 5:15am UTC](https://discuss.elastic.co/t/automatically-updating-the-blacklisted-ip-on-a-daily-basis/42000/3 "2016-02-22T05:15:53Z")
Thanks Magnus. I know that. But the customer here is looking for building SOC (Security operation center) using ELK as a SIEM, which can be a little cumbersome. Best Regards, Praveen K ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 22, 2016, 7:33am UTC](https://discuss.elastic.co/t/automatically-updating-the-blacklisted-ip-on-a-daily-basis/42000/4 "2016-02-22T07:33:46Z")
Okay, but I don't see how that answers the question of why a cronjob wouldn't solve the problem. ---
**Author:** ![joschi99](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@joschi99](https://discuss.elastic.co/u/joschi99)\ **Post date:** [February 16, 2017, 10:44am UTC](https://discuss.elastic.co/t/automatically-updating-the-blacklisted-ip-on-a-daily-basis/42000/5 "2017-02-16T10:44:26Z")
Hi Praveen, we have a similar case. Our blacklists are based on network's and not single ip's. We work also with the translate filter. We would like to use the cidr filter to check if a specific IP matchs a network, but how you can combine cidr filter with lookup datas (from translate)? I remember that if you update the YAML-file using in the translate filter, the update should be automatically, so normally it is enough update the source file for example trough a cron job. Regards, Jochen ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/automatically-updating-the-blacklisted-ip-on-a-daily-basis/42000/6 "2017-07-06T04:28:33Z")