https://community.splunk.com/t5/Splunk-Cloud-Platform/Use-case-Creation/m-p/675204#M2758 <P>Hi Everyone,<BR /><BR />I want to create a new Use case to detect Suspicious activity on insecure ports from remote to local and local to remote. I didn't understand how do I write the query as source IP/Destination IP as remote. Is there any way to define the "Context" like Remote and Local?&nbsp;<BR /><BR />I want to define for L2R rule destination IP should be remote and for R2L Source IP should be Remote. I have tried with the reverse condition but it didn't worked properly.&nbsp;<BR /><BR /><BR />Example: For L2R I have mentioned all the Local IP network segment as not category (Source IP!= 10.0.0.0/8) and for R2L vice versa (Destination IP!=10.0.0.0/8).&nbsp; &nbsp;<BR /><BR />Can anyone help me with this please?&nbsp;</P> Tue, 23 Jan 2024 17:00:20 GMT Abhirup_10 2024-01-23T17:00:20Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Use-case-Creation/m-p/675204#M2758 <P>Hi Everyone,<BR /><BR />I want to create a new Use case to detect Suspicious activity on insecure ports from remote to local and local to remote. I didn't understand how do I write the query as source IP/Destination IP as remote. Is there any way to define the "Context" like Remote and Local?&nbsp;<BR /><BR />I want to define for L2R rule destination IP should be remote and for R2L Source IP should be Remote. I have tried with the reverse condition but it didn't worked properly.&nbsp;<BR /><BR /><BR />Example: For L2R I have mentioned all the Local IP network segment as not category (Source IP!= 10.0.0.0/8) and for R2L vice versa (Destination IP!=10.0.0.0/8).&nbsp; &nbsp;<BR /><BR />Can anyone help me with this please?&nbsp;</P> Tue, 23 Jan 2024 17:00:20 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Use-case-Creation/m-p/675204#M2758 Abhirup_10 2024-01-23T17:00:20Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Use-case-Creation/m-p/675414#M2769 <P>This would heavily depend on what your events look like as you would simply extract fields that represent "remote" and "local" fields.&nbsp;<BR /><BR />Got an example event?</P> Thu, 25 Jan 2024 16:45:26 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Use-case-Creation/m-p/675414#M2769 mattymo 2024-01-25T16:45:26Z