All Apps and Add-ons

Suspected Network Scanning - Fine tuning - exclude DNS and external IPs

rigmm
New Member

Trying to fine tune Suspected Network Scanning since we are getting lots of false positives for our AD server doing DNS lookups and endpoints going to external sites that use lots of Akamai related IPs.  We have the threshold set as 500 (see below) but wondering if we can make the scanning more fruitful by excluding our AD servers doing DNS lookups (port 53) and to exclude all external IPs in our search/query.   I'm assuming we want  Network Scanning to really only look at internal IPs (private ranges).  New to Splunk so please forgive my lack of knowledge.  Thanks!!

| tstats summariesonly=t allow_old_summaries=t dc(All_Traffic.dest_port) as num_dest_port dc(All_Traffic.dest_ip) as num_dest_ip from datamodel=Network_Traffic by All_Traffic.src_ip
| rename "All_Traffic.*" as "*"
| where num_dest_port > 500 OR num_dest_ip > 500
| sort - num_dest_ip

Labels (2)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!