Best way(s) to track changes in count of IPs

[jwalzerpitt]

Every night we scan our external systems for two reasons:

1) To see if unauthorized systems pop up
2) To see if there has been any change in open ports reporting

What would be the best way, or ways, to track this via search. I've been looking at diff, streamstats, delta., and so on, but wanted to hear others' thoughts on this matter.

Thx

[joshd · Accepted solution]

Store the output of the search in a lookup then use inputlookup and do a diff on the counts. You can also store things like 'last seen' 'first seen' etc... in the lookup which would prove useful for other use cases (tracking assets over time, etc).

Also the new KV store in 6.2 provides much more flexibility than lookups, I'd take a peak into that as well.

[somesoni2]

Once stored in lookups/kv store, based on your search get the list/count of IPs, you can use compare yesterday's data (from lookup/kv store) with today's data (search result) using diff, delta or stats. Providing your current search would be helpful in getting more accurate suggestions.

[jwalzerpitt]

johd and somesoni2, thx for the information and recommendations... Much appreciated.