host communication to the internet

Alerting

Hi, I am trying to create an alert for hosts that are communicating to the internet. Want to know the destinations.

But have a lot of trusted destinations to exclude (Aprox. 2800).

The below query gives me all the trusted destinations+other.

index=net sourcetype=proxy dest!=10.1.* 10.2.* sc_status=200 c_ip IN (10.1.10.* 10.1.11.* ) | lookup dnslookup clientip as c_ip OUTPUT clienthost as DNSName
| stats count by c_ip DNSName dest sc_status

Please let me know of any solution.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...