# ELK 7.10 - Indicator index patterns: Value lists

**URL:** <https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287>\
**Category:** SIEM\
**Created:** [February 15, 2021, 8:47am UTC](https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287 "2021-02-15T08:47:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\
**Post date:** [February 15, 2021, 8:47am UTC](https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287/1 "2021-02-15T08:47:45Z")

</div>

Hello,

I am trying to create a indicator match rule in ELK 7.10 where i have to give the indicator index pattern. Is there any default indicator index in ELK 7.10 or do i need to create a new indicator index with IOC logs from external source?

Thanks & regards

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [February 15, 2021, 4:05pm UTC](https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287/2 "2021-02-15T16:05:08Z")

</div>

Currently there is a lot of different ways to set it up. In short, yes, you do need to create and setup an indicator index pattern. We do have file beat which can help out with regards to MISP feeds and modules. There's some caveats such as duplication you have to be careful of as outlined here:

> [@MISP and Elastic Security](https://discuss.elastic.co/t/misp-and-elastic-security/257644/4):
>
> Hello @Ameer_Mukadam, sorry for the slow response, its in the middle of these busy Christmas times slight_smile Let me talk about a few different pointers, so that you have a few choices on which approach you want to go. In terms of tweaking the MISP module, there is some known comments, requests and reports around the module which I am currently working on and while we cannot talk about in which release this might come up, I wanted to at least clarify it is a known case. Now in terms of fi…

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [February 15, 2021, 4:22pm UTC](https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287/3 "2021-02-15T16:22:24Z")

</div>

Hello @jancodenew and @Frank_Hassanabad .

Just wanted to add a small update to the post that was linked.

There has been updates to the MISP module in 7.11 to fix certain caveats like deduplication and better polling intervals: [[Filebeat] MISP improvements by marc-gr · Pull Request #23070 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/23070)

There is also a more IOC focused filebeat module in the making, though cannot speak on specific release dates or versions as they might change at this moment, but keep your eyes open on new release notes 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2021, 4:23pm UTC](https://discuss.elastic.co/t/elk-7-10-indicator-index-patterns-value-lists/264287/4 "2021-03-15T16:23:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.