topic Re: how to create port down alert in Getting Data In

How can I create search and alert if port was down or not listing?

sekhar463 — Mon, 10 Oct 2022 13:46:48 GMT

i have events for port listening on 443

how can i create search and alert if port was down or not liseting

below are the same events

10/10/22
10:35:40.312 AM
2022-10-10 11:35:40.312 transport=TCP dest_ip=[::] dest_port=443 pid=4 appname=System
host = GBLONICORE01Vsource = C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_850\bin\win_listening_ports.batsourcetype = Script:ListeningPorts
10/10/22
10:35:40.312 AM
2022-10-10 11:35:40.312 transport=TCP dest_ip=0.0.0.0 dest_port=443 pid=4 appname=System
host = GBLONICORE01Vsource = C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_850\bin\win_listening_ports.batsourcetype = Script:ListeningPorts
10/10/22
9:35:40.006 AM
2022-10-10 10:35:40.006 transport=TCP dest_ip=[::] dest_port=443 pid=4 appname=System
host = GBLONICORE01Vsource = C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_850\bin\win_listening_ports.batsourcetype = Script:ListeningPorts
10/10/22
9:35:40.006 AM
2022-10-10 10:35:40.006 transport=TCP dest_ip=0.0.0.0 dest_port=443 pid=4 appname=System
host = GBLONICORE01Vsource = C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_850\bin\win_listening_ports.batsourcetype = Script:ListeningPorts

Re: how to create port down alert

gcusello — Mon, 10 Oct 2022 12:18:50 GMT

Hi @sekhar463,

at first you should know the list of hosts to monitor and save this list a a lookup called e.g. perimeter.csv containing at least one column host.

then you could run a search like the following (if the above data are archived in the windows index with the sourcetype=ListeningPort:

If you want to monitor more ports, you can add to the lookup another column with the ports to monitor for each server and modify the search:

Ciao.

Giuseppe

Re: how to create port down alert

sekhar463 — Mon, 10 Oct 2022 13:44:28 GMT

Hi @gcusello Thanks for ur response

for now i want to check for 3 hosts and only wants to monitor port 443 for those

we are using main index for this port data

so now i have created lookup for these hosts only host column

is anything i need to update

Re: how to create port down alert

gcusello — Mon, 10 Oct 2022 14:01:48 GMT

hi @sekhar463,

you could creat an alert for those 3 hosts, but I hint to use the lookup, to have a more flexible solution.

so you could run something like this:

if you don't want to use the lookup, you could use:

Ciao.

Giuseppe

Re: how to create port down alert

sekhar463 — Mon, 10 Oct 2022 14:41:51 GMT

index=main sourcetype=ListeningPort dest_port=443
| eval host=lower(host)
| stats count BY host
| append [ | makeresults | eval host=your_host1, count=0  | fields host count]
| append [ | makeresults | eval host=your_host2, count=0  | fields host count]
| append [ | makeresults | eval host=your_host3, count=0  | fields host count]
| stats sum(count) AS total BY host
| where total=0

is this will show results port is not listening or port was down ?

Re: how to create port down alert

gcusello — Mon, 10 Oct 2022 14:47:47 GMT

Hi @sekhar463,

this search display one or more of these three hosts when there isn't any log containing "dest_port=443".

Ciao.

Giuseppe

Re: how to create port down alert

sekhar463 — Thu, 13 Oct 2022 09:39:58 GMT

what was the trigger condition can i use for the search to alert

Re: how to create port down alert

gcusello — Thu, 13 Oct 2022 09:56:43 GMT

Hi @sekhar463,

no results from the above search means that all the hosts have logs for that port.

If one host appears in the list, it means that there isn't any log with that port definition.

So the condition to trigger in the alert is results=0

Ciao.

Giuseppe

Re: how to create port down alert

sekhar463 — Thu, 13 Oct 2022 10:08:36 GMT

so as per below if results will be there if port 443 is listening based on events i can see

so now if no results for 443 then alert will come if we will keep results is 0

is that correct what i understood

Re: how to create port down alert

gcusello — Fri, 14 Oct 2022 10:43:01 GMT

Hi @sekhar463,

yes correct

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉