Hi,

I am trying to build a rule in which i am able to check if my firewall logs encounter a malicious IP. How I determine whether a IP is malicious is through another log source (which is a TI feed) which is being ingested which contains malicious IPs as events. I then, try to match the two events and see if there are any matches. 

Due to the rule building restriction that we can go only look back upto 2 days in the match section, I want to leverage Data tables where the TTL is upto 90 days. 

For this, i built 2 rules, one which inputs malicious IPs values into my data table, this is based on the log source which is providing me the malicious IPs. Now, here comes the issue. When i made this rule and kept the rule frequency at 10-min, it puts the value for the first time without any issues.

The issue comes at the second iteration, I don't see the data table being updated at all after the first iteration, can it be possible this is due to the fact that the number of detections has crossed 10,000? Because when I test the rule manually, I can see there being latest detections.

Any help is appreciated.