I am trying to identify worst offenders for blocked traffic and then identify all of the locations they are getting blocked. In my basic search
index=cisco_asa action=blocked | top limit=30 src, dest, dest_port I am seeing results example:
Examples of outputs:
What i'm trying to do is get a list of all blocked events for a given source IP, and based on all blocked events, sort the top 25 offenders, and then list out each destination that machine is getting blocked events on. Something similar to this, preferably with the total count somewhere in the results:
Hi there, try this.
... | stats count by dest dest_port src | stats list(dest) as dest, list(dest_port) as destPort, list(count) as count by src as Offender
while this didn't get me what I was looking for, it got me in the right direction:
index=ciscoasa action=blocked | top limit=30 src, dest, destport | stats list(dest) as dest, list(dest_port) as destPort, list(count) as count by src | sort -count