All Apps and Add-ons

Suspected Network Scanning - Fine tuning - exclude DNS and external IPs

rigmm
New Member

Trying to fine tune Suspected Network Scanning since we are getting lots of false positives for our AD server doing DNS lookups and endpoints going to external sites that use lots of Akamai related IPs.  We have the threshold set as 500 (see below) but wondering if we can make the scanning more fruitful by excluding our AD servers doing DNS lookups (port 53) and to exclude all external IPs in our search/query.   I'm assuming we want  Network Scanning to really only look at internal IPs (private ranges).  New to Splunk so please forgive my lack of knowledge.  Thanks!!

| tstats summariesonly=t allow_old_summaries=t dc(All_Traffic.dest_port) as num_dest_port dc(All_Traffic.dest_ip) as num_dest_ip from datamodel=Network_Traffic by All_Traffic.src_ip
| rename "All_Traffic.*" as "*"
| where num_dest_port > 500 OR num_dest_ip > 500
| sort - num_dest_ip
Labels (2)
0 Karma

BrendanCO
Path Finder

Nobody ever answered this, I see. Rats! I have the same question. 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...