% This is generated by ESQL's AbstractFunctionTestCase. Do not edit it. See ../README.md for how to regenerate it.
FROM firewall_logs | LOOKUP JOIN threat_list ON source.IP