Application Protocols list in ES - unclear in documentation

[damode]

The documentation for Application Protocol list in ES states "The Application Protocols list is a list of port and protocol combinations and their approval status in your organization" and shows fields available in the file.

Field Description

dest_port	The destination port number. Must be a number from 0 to 65535.
transport	The protocol of the network traffic. For example, icmp, tcp, or udp.
app	The name of the application using the port.

But where is the field for approval status ? or am I interpreting it in wrong way ?

[lkutch_splunk · Accepted solution]

You're correct, there's no approval status in the application_protocol_lookup. Docs updated, thanks!  The status part for the ports in use by the apps is in interesting_ports_lookup: 

is_required

is_prohibited

is_secure