# Batch Searches for Threat Data - Indicators Of Compromise

**URL:** <https://discuss.elastic.co/t/batch-searches-for-threat-data-indicators-of-compromise/52759>\
**Category:** Elasticsearch\
**Created:** [June 14, 2016, 4:06pm UTC](https://discuss.elastic.co/t/batch-searches-for-threat-data-indicators-of-compromise/52759 "2016-06-14T16:06:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gman1982](https://avatars.discourse-cdn.com/v4/letter/g/5f8ce5/32.png) [@Gman1982](https://discuss.elastic.co/u/Gman1982)\
**Post date:** [June 14, 2016, 4:06pm UTC](https://discuss.elastic.co/t/batch-searches-for-threat-data-indicators-of-compromise/52759/1 "2016-06-14T16:06:06Z")

</div>

Hi,

We're making use of ELK to do daily Operational Searches in Kibana and it is proving extremely useful.

Is there a way to Automate searches, say once or twice a day against our Indices with a script if we had a structured subset of data to search?

We have a number of Indicators of Compromise that come in each day, IPs, URLs etc. It would be great if we could harness Elastic in some way to do batch searches with this data to see if we find any hits in our environment, we could then pivot on this data etc.

APologies if this subject has been broached before, but i couldnt find anything relevant.

Thank you  
Gordon

---

<div class="post-metadata">

**Author:** ![msimos](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@msimos](https://discuss.elastic.co/u/msimos)\
**Post date:** [June 14, 2016, 10:57pm UTC](https://discuss.elastic.co/t/batch-searches-for-threat-data-indicators-of-compromise/52759/2 "2016-06-14T22:57:27Z")

</div>

Hi,

You may want to look at watcher which allows you to create watches to trigger an alert when a certain query matches:

[https://www.elastic.co/guide/en/watcher/current/introduction.html](https://www.elastic.co/guide/en/watcher/current/introduction.html)

---

<div class="post-metadata">

**Author:** ![Gman1982](https://avatars.discourse-cdn.com/v4/letter/g/5f8ce5/32.png) [@Gman1982](https://discuss.elastic.co/u/Gman1982)\
**Post date:** [June 20, 2016, 1:03pm UTC](https://discuss.elastic.co/t/batch-searches-for-threat-data-indicators-of-compromise/52759/3 "2016-06-20T13:03:17Z")

</div>

Thank you. That looks like it could be pretty useful. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:42pm UTC](https://discuss.elastic.co/t/batch-searches-for-threat-data-indicators-of-compromise/52759/4 "2017-07-05T22:42:17Z")

</div>