topic Re: Scan Behavior in Splunk Search

Scan Behavior: How to query the trigger for the same period for three consecutive days?

Dustem — Mon, 11 Sep 2023 16:41:52 GMT

hi guys, I want to detect that more than 10 different ports of the same host are sniffed and scanned every 15 minutes and triggered 5 times in a row, then the alarm; If the same time period is triggered for three consecutive days, the alarm is triggered.
The current SPL:

index="xx"

| bin _time span=15m

| stats dc(dest_port) as dc_ports by _time src_ip dest_ip

| where dc_ports > 10
| streamstats count as consecutive_triggers by src_ip dest_ip reset_on_change=Ture

| where consecutive_triggers>=5

Next, I don't know how to query the trigger for the same period for three consecutive days.

Re: Scan Behavior

gcusello — Mon, 11 Sep 2023 12:19:55 GMT

Hi @Dustem,

you could save the results of you search in a summary index (using the collect command), then execute the alert on the summary index and trigger it if you have more than 3 results.

Ciao.

Giuseppe

Re: Scan Behavior

Dustem — Mon, 11 Sep 2023 13:46:48 GMT

Hi gcusello,

How do I set it to trigger at the same time in three days?

Re: Scan Behavior

gcusello — Mon, 11 Sep 2023 13:53:09 GMT

Hi @Dustem,

you schedule your search every day (using the last day as time frame) and you save the results in a summary index, one event every day.

Then you can schedule a search on the summary index, using three days as time frame.

Ciao.

Giuseppe

Re: Scan Behavior

Dustem — Mon, 11 Sep 2023 14:00:35 GMT

Can I do this by writing SPL?

Re: Scan Behavior

gcusello — Mon, 11 Sep 2023 15:13:16 GMT

Hi @Dustem,

yes, you should create an alert, scheduled e.g. one time day like the following:

that triggers the conditons you need and saves results in a summary index.

then if the alert is named "scan"

you can search on the summary for the search_name="scan" in the last three days:

index=my_summary search_name=scan | stats count BY src_ip dest_ip | where count>5

Obviously you have to adapt my approach to your Use case.

Ciao.

Giuseppe

Re: Scan Behavior

Dustem — Wed, 20 Sep 2023 02:31:02 GMT

Hello gcusello,

Sorry, I forgot to reply. I rewrote SPL myself to complete the requirements, thanks for your help.

Re: Scan Behavior

gcusello — Wed, 20 Sep 2023 06:45:49 GMT

Hi @Dustem ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉