I have been trying to figure out on how to do a search for IP addresses that were hit on more than one Port in a short period of time.
Hi Securitas,
all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port
:
time=10:01 ip=1.1.1.1 port=22
time=10:02 ip=1.1.1.1 port=23
time=10:02 ip=2.2.2.2 port=23
time=10:02 ip=2.2.2.2 port=21
time=10:03 ip=1.1.1.1 port=80
Running this search will return connects to more than one port by time:
sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1
If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time
value):
sourcetype="ip_port" | addinfo | eval _time=_indextime
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1
If you want to see which IP's got connection to the same port at the same time use this:
sourcetype="ip_port" | chart values(port) AS ports over time by ip
Hope this helps to get you started ...
cheers, MuS
Hi Securitas,
all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port
:
time=10:01 ip=1.1.1.1 port=22
time=10:02 ip=1.1.1.1 port=23
time=10:02 ip=2.2.2.2 port=23
time=10:02 ip=2.2.2.2 port=21
time=10:03 ip=1.1.1.1 port=80
Running this search will return connects to more than one port by time:
sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1
If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time
value):
sourcetype="ip_port" | addinfo | eval _time=_indextime
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1
If you want to see which IP's got connection to the same port at the same time use this:
sourcetype="ip_port" | chart values(port) AS ports over time by ip
Hope this helps to get you started ...
cheers, MuS
Thanks. That's within the confines of what I was looking for.
Cheers Mate.