All Apps and Add-ons

Suspected Network Scanning - Fine tuning - exclude DNS and external IPs

rigmm
New Member

Trying to fine tune Suspected Network Scanning since we are getting lots of false positives for our AD server doing DNS lookups and endpoints going to external sites that use lots of Akamai related IPs.  We have the threshold set as 500 (see below) but wondering if we can make the scanning more fruitful by excluding our AD servers doing DNS lookups (port 53) and to exclude all external IPs in our search/query.   I'm assuming we want  Network Scanning to really only look at internal IPs (private ranges).  New to Splunk so please forgive my lack of knowledge.  Thanks!!

| tstats summariesonly=t allow_old_summaries=t dc(All_Traffic.dest_port) as num_dest_port dc(All_Traffic.dest_ip) as num_dest_ip from datamodel=Network_Traffic by All_Traffic.src_ip
| rename "All_Traffic.*" as "*"
| where num_dest_port > 500 OR num_dest_ip > 500
| sort - num_dest_ip
Labels (2)
0 Karma

BrendanCO
Path Finder

Nobody ever answered this, I see. Rats! I have the same question. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...