How to setup spur feeds in SecOps?

[zeekforit]

Hello,

Good day. Wanted to ask if you have any idea how we should setup spur feeds in SecOps ? Is it done through feeds? If it is, would you be able to suggest how we should configure it ? We are getting a compressed file from spur which is around 4gb and 12m of lines and struggling how we can make it work together with SecOps to be able to track connections from Anonymous IPs. Thank you.

[David-French]

Hi @zeekforit,

I believe you should be able to create a feed in Google SecOps to ingest Spur data feeds from a location like a Google Cloud Storage bucket and choose the "Spur data feeds" log type when configuring the feed.

I don't have a Spur subscription myself, but I do have a sample data set that I obtained earlier this year. I just attempted the above using my sample data set and am seeing an "INTERNAL_ERROR" message though 🤔

Can you attempt to create a new feed using your Spur data and let me know how it goes?