# \[ URLHaus threat intelligence \]: create a new rule

**URL:** <https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857>\
**Category:** SIEM\
**Tags:** elastic-stack-alerting\
**Created:** [January 12, 2021, 3:49pm UTC](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857 "2021-01-12T15:49:44Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [January 18, 2021, 1:20pm UTC](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857/13 "2021-01-18T13:20:55Z")

</div>

Hello again,

So I did as you and @hilo21 suggested, I used a`grok` filter, and separated the indicators.  
The grok filter I used is:

```auto
    grok {
      match => { "url" => "%{URIPROTO:uri_proto}:\/\/(%{IP:destination.ip}:%{NUMBER:destination.port})?(%{URIHOST:domain})?\/%{GREEDYDATA:uri_para}" }
    }

```

( somtimes the indicator is an IP address and port and sometimes it's URL, that why my filter looks like that)

and my rule is like that:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e2727321b005b1f7ab6f93f2720ab58a3c679b54.png)

the only problem is that I am getting this error while creating the rule so I couldn't test if it's working correctly :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/2/82e2afc81dc6d507eb4389557861779ba228b1ba.png)

So I created a new Topic here :

> [@\[Creating new rule \]: ERROR Authentication using apikey failed - api key has been invalidated](https://discuss.elastic.co/t/creating-new-rule-error-authentication-using-apikey-failed-api-key-has-been-invalidated/261407):
>
> Hello, I am using elasticsearch, kibana and beats version 7.10.1 with a Trial license, I am trying to create a new Match rule and in my elasticsearch node I am getting this error: [2021-01-18T11:33:18,032][WARN][o.e.x.s.a.AuthenticationService] [DATA-03] Authentication using apikey failed - api key has been invalidated [2021-01-18T11:33:18,035][WARN][o.e.x.s.a.AuthenticationService] [DATA-03] Authentication using apikey failed - api key has been invalidated and in kibana interface: Rule …

---

_[View the full topic](https://discuss.elastic.co/t/urlhaus-threat-intelligence-create-a-new-rule/260857)._