I have a Squid web proxy with an in house cert on it. We've gone through and applied the root certs to all our hosts and set it as trusted and it's working great. What I am looking to do is create an alert in Splunk that is a host tries to hit our proxy and fails the, I get an alert.
I am assuming there is a SSL cert disconnect message of some sorts in Stream I can capture. But I am not sure what streams to configure. Point me in the right direction?