How to setup spur feeds in SecOps?

[zeekforit]

Hello,

Good day. Wanted to ask if you have any idea how we should setup spur feeds in SecOps ? Is it done through feeds? If it is, would you be able to suggest how we should configure it ? We are getting a compressed file from spur which is around 4gb and 12m of lines and struggling how we can make it work together with SecOps to be able to track connections from Anonymous IPs. Thank you.