topic In Splunk Enterprise Security, how do you use a regular expression to find destination port numbers? in Splunk Enterprise Security

In Splunk Enterprise Security, how do you use a regular expression to find destination port numbers?

kokanne — Fri, 11 Jan 2019 11:44:09 GMT

I want to make a usecase that will detect the usage of several destination port numbers. For this, I think it's easiest to use a regular expression. But I'm not sure. I'm also having trouble implementing a regular expression into my query. I've never worked with them before.

Please evaluate the following information and tell me what you think is best to develop the query.

The usecase must be easy to add or remove any port numbers from, in case we want to detect other things.
The usecase must be able to detect ranges of port numbers when indicated.

Now, for what I've tried is the following:

index=network
| regex dest_port>="688[1-9]"

But this doesn't work. I will use datamodel later.
The range for the ports is:

6881 to 6889
6969

In addition to those ports, we also want it to alert when it finds the following strings in the field app_category:

app_category field contains tracker
app_category field contains torrent

Any help would be much appreciated. I think someone with a lot of regular expression experience will be able to make the query easily, I've been stuck on it for hours sadly and I would love some help.

Thanks!

Re: In Splunk Enterprise Security, how do you use a regular expression to find destination port numbers?

renjith_nair — Tue, 29 Sep 2020 22:44:59 GMT

@kokanne ,

For the dest_port, try

index=network | regex dest_port="688[1-9]|6969"

and for the app_category, you could search with (app_category="*tracker*" OR app_category="*torrent*")

Or if both conditions are to be matched , try

index=network |where (match(dest_port,"688[1-9]|6969") OR match(app_category,"tracker|torrent"))

Re: In Splunk Enterprise Security, how do you use a regular expression to find destination port numbers?

woodcock — Sat, 12 Jan 2019 00:25:43 GMT

Like this (breaks down at 1000 values):

index=network [ |makeresults | eval port=mvappend(mvrange(6881, 6889, 1), "6969") | format ]

Re: In Splunk Enterprise Security, how do you use a regular expression to find destination port numbers?

woodcock — Sat, 12 Jan 2019 00:26:33 GMT

Do NOT use regex because it does not map-reduce and you will pull all the values out only to throw them away and your search will take 1000x longer than the way that I just showed you.