Say, we have events like this: _time fw src_ip dest_ip dest_port fw_rule_action 8/1/22 1:30:00.000 AM fw1 192.168.50.51 8.8.8.8 53 block 1/1/22 1:30:00.000 AM fw1 192.168.50.51 8.8.8.8 53 permit 12/31/21 1:30:00.000 AM fw1 192.168.50.51 8.8.8.8 53 permit   We want to find the events that changed based on fw_rule_action. The real world scenario can be that you consolidated the (whatever) rule base and after application, you want to see, if some events are permitted that were blocked in the past and vice visa. What is the right approach to find the (in this example) block events? Is creating a baseline the right way? ... View more