Currently I have three scheduled searches that run once a day to baseline possible APT on our network by showing the top 25 hosts for total bytes, connections and length of time for connections through our firewall. The searches take some time to run even with report acceleration enabled, so they are run during the night. I would like to identify hosts that show up on all three top 25 reports. I have all three in a dashboard that allows me to manually view and identify hosts, however it would be easier if it could also be automated. What I would like is to have a search run across the result sets of the three top 25 APT reports that would display any host showing up on all three.
If anyone has any suggestions, I would appreciate it. Thanks in advance.