# Match against threat feed entries without Enterprise license

**URL:** <https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771>\
**Category:** Elasticsearch\
**Created:** [April 3, 2025, 9:03pm UTC](https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771 "2025-04-03T21:03:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\
**Post date:** [April 3, 2025, 9:03pm UTC](https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771/1 "2025-04-03T21:03:10Z")

</div>

We use Filebeat to ingest network logs. We're experimenting with threat feed ingestion, and would like to find matches between fields in our logs (say `destination.ip`) and entries in the threat feed. Is there a way to do this on the Free & Open tier? We don't need alterting capabilities (we do this with Elastalert).

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 3, 2025, 10:14pm UTC](https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771/2 "2025-04-03T22:14:10Z")

</div>

If I'm not wrong the only way to do that is by creating a Threat Indicator security rule.

---

<div class="post-metadata">

**Author:** ![hendry.lim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendry.lim/32/71328_2.png) [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\
**Post date:** [April 4, 2025, 5:00am UTC](https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771/3 "2025-04-04T05:00:46Z")

</div>

You can try the new ES|QL `LOOKUP JOIN` that will be available in the upcoming release.

---

<div class="post-metadata">

**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\
**Post date:** [April 4, 2025, 2:42pm UTC](https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771/4 "2025-04-04T14:42:45Z")

</div>

Interesting. I'll check that out - thanks!