Hi All,The following search has been created to identify the unsecure communications.Also i need to see the end-to-end connectivity if it’s successful on unsecure protocol. For example, some services are configured in F5 with HTTP redirection profile. Now ultimately you will observe port 80 traffic on Edge firewall but F5 then redirects it to HTTPS.so please could you help us to achive these?
(index=paloalto OR index=juniper) (dest_port= 20 OR
dest_port= 22 OR
dest_port= 23 OR
dest_port= 53 OR
dest_port= 139 OR
dest_port= 80 OR
dest_port= 445 OR
dest_port= 3389 OR
dest_port= 21) | lookup Port_service.csv dest_port as dest_port OUTPUT service | stats count values(src_ip) by dest_port service dest_ip transport action | table values(src_ip) dest_port service transport dest_ip count action
