I'd like an alert that runs against ASA firewall logs and shows the top 20 source addresses and top 20 destination addresses in a single search if possible. Conversation pairs dont matter, just top 20 source ips and top 20 dest ips. And if its too much trouble to split out source and destination then simply counting how many times an IP shows up as either source or destination would suffice.
I can get it to work with two different alerts if I use the search strings below, but ideally it would be a combined alert.
index=x host=x | stats count by dest_ip | eventstats sum(count) as total_count | sort by -count| head 20 | where total_count > 100000
index=x host=x | stats count by src_ip | eventstats sum(count) as total_count | sort by -count| head 20 | where total_count > 100000
Alert configured to trigger if result count > 1
