Sorry for lack of details, I am at that place of not even quite understanding what i'm asking for yet lol! Let me try and describe: I have a bunch of data ingested from a proxy log that I'm not actually interested in, but two of the accelerated fields are user and url which both populate from access logs (beyond this, I am not sure what extra detail would be helpful). I want to search for URLs which are IOCs (I have a known short list of them), and then separately compile a report of if any user has interacted with more than one of these URLs. I don't really need the volume of access, primarily just the usernames of any user that has indeed hit more than one criteria. I had started creating searches/reports individually for each URL and was going to make a lookup table with the results which I could then produce a further report from but this feels overly complicated for what seems like a simple enough task. Thanks for your help!
... View more