Hi, I am trying to create an alert for hosts that are communicating to the internet. Want to know the destinations.
But have a lot of trusted destinations to exclude (Aprox. 2800).
The below query gives me all the trusted destinations+other.
index=net sourcetype=proxy dest!=10.1.* 10.2.* sc_status=200 c_ip IN (10.1.10.* 10.1.11.* ) | lookup dnslookup clientip as c_ip OUTPUT clienthost as DNSName
| stats count by c_ip DNSName dest sc_status
Please let me know of any solution.
