Dashboards & Visualizations

Port Scan Dashboard

tonythomas42
New Member

I want a dashboard to be created for port scan(to detect 2000 port scan attempts from one single IP towards single destination within 5 min)
I tried creating one dashboard but the values in the dashboard keep on changing every time the dashboard refreshes. I want a dashboard that will display all the port scan attempts for last 24 hrs satisfying the condition (2000 port scan attempts in 5 min) and the values in the dashboard should stay till 24 hrs.

Tags (1)
0 Karma

sumanssah
Communicator

try using below-mentioned search for "port scan to single IP multiple ports"

| tstats `summariesonly`   dc(All_Traffic.dest_port) as dc_dest_port  values(All_Traffic.dest_zone) as dest_zone min(All_Traffic.dest_port) as min_port max(All_Traffic.dest_port as max_port values(All_Traffic.action) as action  from datamodel=Network_Traffic.All_Traffic where NOT (All_Traffic.dest_port=443 OR  All_Traffic.dest_port=80 )  by All_Traffic.src_ip All_Traffic.dest_ip _time span=5m
| `drop_dm_object_name(All_Traffic)`  
| where dc_dest_port>2000  
| eval ip_range=min_port."-".max_port
0 Karma

to4kawa
Ultra Champion

Which do you want to do?
Create something: good luck. you only know your logs.
Find Apps: splunk security essentials

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...