Splunk Search

How to edit my search to identify blocked network traffic and top the worst offenders?

umplebyj
Explorer

Hello,

I am trying to identify worst offenders for blocked traffic and then identify all of the locations they are getting blocked. In my basic search index=cisco_asa action=blocked | top limit=30 src, dest, dest_port I am seeing results example:

Examples of outputs:

alt text

What i'm trying to do is get a list of all blocked events for a given source IP, and based on all blocked events, sort the top 25 offenders, and then list out each destination that machine is getting blocked events on. Something similar to this, preferably with the total count somewhere in the results:

alt text

0 Karma
1 Solution

alemarzu
Motivator

Hi there, try this.

... | stats count by dest dest_port src | stats list(dest) as dest, list(dest_port) as destPort, list(count) as count by src as Offender

View solution in original post

alemarzu
Motivator

Hi there, try this.

... | stats count by dest dest_port src | stats list(dest) as dest, list(dest_port) as destPort, list(count) as count by src as Offender

umplebyj
Explorer

while this didn't get me what I was looking for, it got me in the right direction:

index=cisco_asa action=blocked | top limit=30 src, dest, dest_port | stats list(dest) as dest, list(dest_port) as destPort, list(count) as count by src | sort -count

0 Karma

alemarzu
Motivator

Oh I see, I forget that | top limit=30 ... my bad. Glad It works tho

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...