I understand that you have data like in the below and this data is updated daily. What you wanted to do is create some alert/report with historical data or daily data. So lets say your data is like on
Monday
IP Port
10.230.32.12 443
10.10.10.10 80
3.24.31.234 25
Tuesday
IP Port
10.11.12.13 1139
23.45.125.243 139
Firstly you should create and schedule a query that Runs every night at 00:00 and search for Yesterday .
In your query you should write the neccesary data to your outputlookup for using in the future
index=nmap_data |table _time,IP,port| outputlookup portscan_list append=t
Now you have outputlookup like
Time IP Port
Monday 10.230.32.12 445
Monday 10.10.10.10 80
Monday 3.24.31.234 25
Tuesday 10.11.12.13 1139
Tuesday 23.45.125.243 139
Now you can create alert from this outputlookup according to your need. Lets say you guys dont want to have open ports on default SMB port since it has some high risks. Then you can set an alert like
|inputlookup portscan_list | search (port=139 OR port=445) and you can Schedule this to run daily/weekly/monthly as you need.
... View more