Feedback:

mdti_ssl

Note: mdti_ssl operator was formerly called the riskiq_ssl operator.

Use the mdti_ssl operator to enrich results related to an IP address or domain name or field containing an IP address or domain name using the ThreatStream MDTI enrichment.

Syntax

|mdti_ssl <field or value>

<field or value>

Specify the field name or IP address or domain name to look up.

Usage

You can use the mdti_ssl operator to enrich results with data from the ThreatStream MDTI integration.

Examples

Example 1: Enrich source IP addresses with MDTI enrichment data.

Copy 
|mdti_ssl src_ip

Example 2: Enrich a specific domain with MDTI enrichment data.

Copy 
|mdti_ssl 'example.com'

Example 3: Enrich a specific IP address with MDTI enrichment data.

Copy 
|mdti_ssl '192.0.2.1'

Example 4: Queries Microsoft Defender Threat Intelligence for SSL certificate data associated with the IP 91.92.253.35

Copy 
ocsf | mdti_ssl '91.92.253.35'