I currently have one alert that tells me if the results exceed more than 5k packets blocked by our firewall. I then have to check and see if the results have any packets allowed in Sourcefire. But only need to check the packets that exceeded 5k in the firewall.
Here is the search string that kicks off the alert of blocked firewall traffic.
index=firewalls sourcetype="cisco:asa" action=blocked description!="Debugging messages only" | fillnull value="n/a" | stats count by src_ip, dest_ip | search count>5000 | rename src_ip as SrcIP, dest_ip as DestIP
I then check in Sourcefire to see if any of those packets had any allowed packets in Sourcefire.
sourcetype="cisco:sourcefire:appliance:syslog" SrcIP="based on the results of the alert above" DstIP="based on the results of the alert above"
I am not too familiar with Sourcefire, but if that information is kind of static (updated once a day) you might want to put that into a lookup within Splunk. That way you can lookup for each packet event if it is in your Sourcefire lookup and continue your work from there on.
In order to get the Sourcefire lookup, you can use a scheduled search that uses outputlookup.
You should either include the second search in with your first search by using an OR like the example below. OR you could setup a second alert which will monitor the internal logs and see when the first alert condition is true and fire its logic