I'm a bit of a rookie and trying to tune the "Threat Activity Detected" correlation search in ES. I would like to take the output of the default search and compare the src, dest, _time from a search on the firewall. I would also output the action= from the firewall and if action=allowed then alert. I plan to create the same for repeat attempts, but trying to get past the comparison.
