From 9b0a17b72ae5875248f484a2b769a9a0080e8127 Mon Sep 17 00:00:00 2001 From: munzzyy Date: Sun, 2 Aug 2026 10:18:52 -0500 Subject: [PATCH] Fix WILDCARD field name in malware_user_agents lookup The lookup declares match_type WILDCARD(malware_user_agents), but the CSV column is malware_user_agent, so Splunk applies wildcard mode to a field that does not exist and the real column falls back to exact matching. The 11 wildcard rows in the file (arkei/*, User-Agent:Mozilla/* and so on) can then only match a user agent that literally contains the asterisk, and HTTP Malware User Agent silently misses everything they cover. Point WILDCARD at the real column and bump the lookup version and modification date. --- lookups/csv/malware_user_agents.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lookups/csv/malware_user_agents.yml b/lookups/csv/malware_user_agents.yml index 19a7fac111..ee4b37bda5 100644 --- a/lookups/csv/malware_user_agents.yml +++ b/lookups/csv/malware_user_agents.yml @@ -1,12 +1,12 @@ name: malware_user_agents id: 3a1a501c-d65f-4a6c-95a3-3d2b9a8c43c3 -version: 2 +version: 3 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-08-02' author: Raven Tait, Splunk lookup_type: csv description: A list of user agents used with known malware. match_type: - - WILDCARD(malware_user_agents) + - WILDCARD(malware_user_agent) min_matches: 1 case_sensitive_match: true