https://community.splunk.com/t5/Getting-Data-In/Detecting-Port-Knocking/m-p/436369#M76130 <P>I'm looking for specific conditions where 2 or more ports (as seen by firewall) have allowed events (action=allowed) and then a third port, typically with a service such as port 22 is the final request. This far, I am working with:</P> <P><CODE>index=firewall_index<BR /> | bin _time span=5m<BR /> | stats count, values(dest_zone) as dest_zone, values(dest_port) as dest_port,<BR /> values(user) as User by _time src_zone src_ip dest_ip <BR /> | where (src_zone != dest_zone)<BR /> | bin _time as Day span=1d <BR /> | eventstats values(dest_port) as all_dest_ports by Day src_ip dest_ip<BR /> | where (mvcount(dest_port) &gt;= 5) OR (mvcount(all_dest_ports) &gt;= 25)</CODE></P> <P>which was borrowed for a port scan search.</P> Thu, 13 Dec 2018 13:20:46 GMT drico618 2018-12-13T13:20:46Z https://community.splunk.com/t5/Getting-Data-In/Detecting-Port-Knocking/m-p/436369#M76130 <P>I'm looking for specific conditions where 2 or more ports (as seen by firewall) have allowed events (action=allowed) and then a third port, typically with a service such as port 22 is the final request. This far, I am working with:</P> <P><CODE>index=firewall_index<BR /> | bin _time span=5m<BR /> | stats count, values(dest_zone) as dest_zone, values(dest_port) as dest_port,<BR /> values(user) as User by _time src_zone src_ip dest_ip <BR /> | where (src_zone != dest_zone)<BR /> | bin _time as Day span=1d <BR /> | eventstats values(dest_port) as all_dest_ports by Day src_ip dest_ip<BR /> | where (mvcount(dest_port) &gt;= 5) OR (mvcount(all_dest_ports) &gt;= 25)</CODE></P> <P>which was borrowed for a port scan search.</P> Thu, 13 Dec 2018 13:20:46 GMT https://community.splunk.com/t5/Getting-Data-In/Detecting-Port-Knocking/m-p/436369#M76130 drico618 2018-12-13T13:20:46Z https://community.splunk.com/t5/Getting-Data-In/Detecting-Port-Knocking/m-p/436370#M76131 <P>@drico618 "such as port 22" as in only port 22 or any port?</P> Thu, 13 Dec 2018 17:23:54 GMT https://community.splunk.com/t5/Getting-Data-In/Detecting-Port-Knocking/m-p/436370#M76131 whrg 2018-12-13T17:23:54Z