# Compare Packetbeat Input to Threat Intelligence Input

**URL:** <https://discuss.elastic.co/t/compare-packetbeat-input-to-threat-intelligence-input/69735>\
**Category:** Kibana\
**Created:** [December 22, 2016, 6:16am UTC](https://discuss.elastic.co/t/compare-packetbeat-input-to-threat-intelligence-input/69735 "2016-12-22T06:16:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\
**Post date:** [December 22, 2016, 6:16am UTC](https://discuss.elastic.co/t/compare-packetbeat-input-to-threat-intelligence-input/69735/1 "2016-12-22T06:16:06Z")

</div>

Hi all,

I have two indexes, one is packetbeat, one is threat intelligence feed. Is there any way I can compare the source/destination IP in the captures of packetbeat to the one in the threat intelligence feed?

If anyone is interested, I'm currently using combine plus logstash csv input to bring in the threat intelligence feed.

Combine: [https://github.com/mlsecproject/combine](https://github.com/mlsecproject/combine)

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [December 22, 2016, 4:17pm UTC](https://discuss.elastic.co/t/compare-packetbeat-input-to-threat-intelligence-input/69735/2 "2016-12-22T16:17:55Z")

</div>

Since you can't join the data you want to add the intelligence data to the packetbeat index. I would recommend taking a look at [Logstash](https://www.elastic.co/products/logstash).

---

<div class="post-metadata">

**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\
**Post date:** [December 23, 2016, 12:02am UTC](https://discuss.elastic.co/t/compare-packetbeat-input-to-threat-intelligence-input/69735/3 "2016-12-23T00:02:39Z")

</div>

@tsmalley I'm using logstash right now. Are you saying I should have one index, which is a combination of my intel data and packetbeat data?

---

<div class="post-metadata">

**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\
**Post date:** [December 23, 2016, 12:46am UTC](https://discuss.elastic.co/t/compare-packetbeat-input-to-threat-intelligence-input/69735/4 "2016-12-23T00:46:50Z")

</div>

The threat intel input is from a csv, is there any way for me to compare a field in the packetbeat input to a field in this csv?

E.g. If [ip] == [somefieldincsv] then output to different index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2017, 12:47am UTC](https://discuss.elastic.co/t/compare-packetbeat-input-to-threat-intelligence-input/69735/5 "2017-01-20T00:47:03Z")

</div>

Closed on January 20, 2017, 12:47am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.