Hi Giuseppe, Thank you for your help on this! That's correct! I want to enrich the result of the search with the information about TLS. I want to highlight the condition TLS=1.2 There are two parts of it  Using below command, I am getting the list of domains within specific time frame "index="pp_index" sourcetype="pp_messagelog" | rex field=envelope.from "(?<=@)(?<domain>([a-zA-z0-9.-]*))" | dedup domain | table domain" AND I have the list of domains which is stored in domains.csv "| inputlookup Domains.csv" I want to check the domains from the list (domains.csv) with the source (pp_messagelog) and check if it's using TLS 1.2 or not. If the domain is not from the list then simply ignore that domain. Hope this helps! Thanks, Nitin ... View more

Hi Giuseppe, Thank you for your help on this! I got the list of domains from domains.csv. I want to search those domains against inbound emails which is stored in sourcetype = PP_messagelog. I want to match the sender domain field and check if they are using proper email security protocols or not by verifying TLS, SPF, DKIM DMARC etc. There is a field called "connection.tls.inbound.version" so I can check from that CSV that this domain is using TLS v1.2 or 1.1 or 1 For example, If the list contains gmail.com. I will check gmail.com against search and using the above field, find out that whether gmail.com is using TLSv1.2 or not. Hope this helps Thanks, Nitin   ... View more