Expression TLS on Unusual Ports

  - name: "TLS on unusual ports"
    when: "afterClassify"
    log: true
    expression: "protocols == tls && port.dst != [443, 8443, 993, 995, 465, 636]"
    ops:
      tags: "tls-odd-port"