Hi @Rawabi1994,
the information you share are really few to help you!
Anyway, when you speak of firewall and endpoint availability, do you mean the you're receiving logs from your firewalls and endpoints?
If this is your need, you could create a lookup containing the list of firewall (and another for endpoints) to check, called e.g. FW_perimeter.csv.
Then you have to run a search like this:
index=firewalls
| head 10
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup FW_perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0
in this way, you'll have a list of firewalls of your lookup that didn't send logs in the last period (e.g. 5 minutes).
Put attention to the host field, check if this field contains an hostname or an IP addres in the results and use the same in the lookup.
It's also possible to automatically update the lookup, running a scheduled search (e.g. every night) on the Firewalls that sent logs in the last month, but i don't like this solution because in this way you loose the control of the monitored list.
Ciao.
Giuseppe
