How to search ASA Built/Allowed events and the following Teardown event with the same source and destination IP?

[CYBR_AH]

Hi everyone,

I'm trying to think of a way where I can find a built/allowed ASA event and the following teardown event (with same source IP and destination IP). My end goal is to be able to find any events that may just have a built/allowed and is missing the teardown event. Any help would be awesome!

[renjith_nair · Accepted solution]

If you just want to see the missing the teardown is to look for the events which has only starting part of event.

Try something like this

your search ( event="allowed" OR event="teardown") |stats first(event) as latest_event by ip,other fields | search latest_event="allowed"

Not sure how your events look like and their field names but try the above dummy search with your original fields. This will extract all the latest event per IP and then the events which has only starting but no ending