Upload a CSV file to the bucket. In this example, ip-dst_misp_example.csv. You can upload it to any location you want in the bucket. In the following example, we’ve uploaded it under the root folder of the bucket, in a folder called lookups_csv.

Navigate to the Objects tab inside your bucket and locate your CSV. Click it to display its properties.

Get the Key and the AWS Region of the CSV file by clicking on the button in the Key section.

Get or create an Access Key for your IAM User and obtain its Secret Key so the Lookups Manager can access your AWS Account.

Create a JSON payload to be added to your lookup creation request to the API. It must include a Source object which does not include a query attribute, but includes a fileProvider one with the name of the bucket, the access key and the secret key of the AWS IAM User, the AWS region where the bucket has been created and the key of the file. For example:

Create a HTTP POST or PUT request with the created payload:

/lookup-api/lookup/lookups_domain/IPsLookup/deploy-config' \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data-raw '{ "visibility": "creator-only", "recipe": { "recipeType": "once", "source": { "columns": [ { "name": "ipAddr", "from": 0, "type": "IP4" }, { "name": "firstSeen", "from": 1, "type": "STRING" }, { "name": "lastSeen", "from": 2, "type": "STRING" }, { "name": "comment", "from": 3, "type": "STRING" } ], "skipPreface": null, "hasHeader": true, "skipEmptyLines": false, "fileProvider": { "bucketName": "devo-lookups-client1-stage", "keyName": "lookups_csv/ip-dst_misp_example.csv", "accessKey": "abcdefghijkl", "secretKey": "Tg4T0aGKvd/aaaaaaaWWQv3Vs0kS15tpn3kbd0V2UZ", "region": "eu-west-1", "transferOwnership": false } }, "lookupType": { "type": "normal" }, "append": false, "key": { "type": "column", "column": "ipAddr" }, "columnFilter": [ "ipAddr", "firstSeen", "lastSeen", "comment" ], "contribution": { "type": "add" }, "requiresDate": false } }']]>

You should get a response similar to this:

You can check for the state of the creation/update querying the /<domain>/<lookup>/job/<id> and if you see the message Lookup ready to be executed, you can start using the lookup.

/lookup-api/lookup/lookups_domain/IPsLookup/job/baa1b1ef-6430-11ed-9fc0-efb84bae0957' \ --header 'Authorization: Bearer ' { "type": "LookupJobStagesListResponse", "cid": "b5c3f2981537", "code": 200, "context": null, "id": "47c2b160-6431-11ed-9fc0-cd58ebae0bc3", "msg": "Lookup jobs", "jobs": [ { "eventdate": "2022-11-14T15:26:49.14", "domain": "lookups_domain", "lookup": "IPsLookup", "msg": "Lookup successfully created" "code": "create.ok" }, { "eventdate": "2022-11-14T15:27:11.767", "domain": "lookups_domain", "lookup": "IPsLookup", "msg": "Lookup ready to be executed" "code": "deploy.ok" } ], "nextPageToken": 1668439608968 }]]>

Prerequisites

Procedure