Outputlookup a baseline lookup and query for anomalies based on baseline lookup?

[antoniolamonica]

Say I create a query that outputs (as a csv) the last 14 days of hosts and the dest_ports the host has communicated on.

Then I would inputlookup that csv to compare the last 7 days of the same type of data.

What would be simplest spl to detect anomalies?

[ITWhisperer]

This requirement is too broad - what sort of anomalies are you trying to detect?

[antoniolamonica]

Use case would be if a host is talks to a port it doesn’t usually talk on based on the baseline.  The timeframes in the question are arbitrary. Would start smart to test, and expand the timeframe for the baseline prior to fully implementing it.  

[ITWhisperer]

You could lookup the host and dest_port to retrieve another value from the lookup store e.g. last time accessed (if you have saved that as well), then if no data is retrieved, the host and dest_port is unknown