% This is generated by ESQL's AbstractFunctionTestCase. Do no edit it. See ../README.md for how to regenerate it.
FROM firewall_logs | LOOKUP JOIN threat_list ON source.IP | WHERE threat_level IS NOT NULL