https://community.splunk.com/t5/Splunk-Search/Search-help/m-p/559327#M158917 <P><SPAN>Hi All,</SPAN><SPAN>The following search has been created to identify the unsecure communications.</SPAN><SPAN>Also i need to see the end-to-end connectivity if it’s successful on unsecure protocol. For example, some services are configured in F5 with HTTP redirection profile. Now ultimately you will observe port 80 traffic on Edge firewall but F5 then redirects it to HTTPS.so please could you help us to achive these?</SPAN></P><P><SPAN>(index=paloalto OR index=juniper) (dest_port=</SPAN> <SPAN>20 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>22 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>23 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>53 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>139 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>80 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>445 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>3389 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>21) | lookup Port_service.csv dest_port as dest_port OUTPUT service | stats count values(src_ip) by dest_port service dest_ip transport action&nbsp; | table values(src_ip) dest_port service transport dest_ip count action</SPAN></P> Wed, 14 Jul 2021 13:15:52 GMT vikkysplunk 2021-07-14T13:15:52Z https://community.splunk.com/t5/Splunk-Search/Search-help/m-p/559327#M158917 <P><SPAN>Hi All,</SPAN><SPAN>The following search has been created to identify the unsecure communications.</SPAN><SPAN>Also i need to see the end-to-end connectivity if it’s successful on unsecure protocol. For example, some services are configured in F5 with HTTP redirection profile. Now ultimately you will observe port 80 traffic on Edge firewall but F5 then redirects it to HTTPS.so please could you help us to achive these?</SPAN></P><P><SPAN>(index=paloalto OR index=juniper) (dest_port=</SPAN> <SPAN>20 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>22 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>23 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>53 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>139 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>80 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>445 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>3389 OR</SPAN><BR /><SPAN>dest_port=</SPAN> <SPAN>21) | lookup Port_service.csv dest_port as dest_port OUTPUT service | stats count values(src_ip) by dest_port service dest_ip transport action&nbsp; | table values(src_ip) dest_port service transport dest_ip count action</SPAN></P> Wed, 14 Jul 2021 13:15:52 GMT https://community.splunk.com/t5/Splunk-Search/Search-help/m-p/559327#M158917 vikkysplunk 2021-07-14T13:15:52Z