https://community.splunk.com/t5/Splunk-Enterprise-Security/Device-discovery-query/m-p/563724#M10210 <P>Splunk only knows what it's told.&nbsp; It doesn't know what devices are listening to what ports, but it might know (if told) that "at 10:00 today the 'netstat -l' command on host foo said these processes are listening on port 80" or "based on the network connection logs, here are the active connections to port 80".</P> Wed, 18 Aug 2021 00:19:57 GMT richgalloway 2021-08-18T00:19:57Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Device-discovery-query/m-p/563706#M10209 <P>Hello!</P><P>I was asked to find what IP addressable devices are listening on port 80 on our network. Can I find this information through a query? I'm new to Splunk analysis so I apologize if this seems basic.</P><P>Any and all help is greatly appreciated. Thanks!</P> Tue, 17 Aug 2021 20:08:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Device-discovery-query/m-p/563706#M10209 learnyboi1 2021-08-17T20:08:16Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Device-discovery-query/m-p/563724#M10210 <P>Splunk only knows what it's told.&nbsp; It doesn't know what devices are listening to what ports, but it might know (if told) that "at 10:00 today the 'netstat -l' command on host foo said these processes are listening on port 80" or "based on the network connection logs, here are the active connections to port 80".</P> Wed, 18 Aug 2021 00:19:57 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Device-discovery-query/m-p/563724#M10210 richgalloway 2021-08-18T00:19:57Z