Monitoring Splunk

How can I use Splunk to monitor network ports on servers?

heathramos
Path Finder

I need to be able to generate an email alert when a new port is opened on a server.

what is the best way to do this?

The only thing I can think of is to create a lookup table with hostname and open ports and maybe reference my nessus scans for open ports (since the nessus scan data is already in my splunk indexes).

is there a better/easier way?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The general statement is that you can detect anything in splunk that is present in splunk. So, first, you have to get records into splunk that contain the information about either (A) which ports are open, or (B) which ports are accessed. B is late to the party, so you probably want A, and so your nessus scans are probably the right way to go.

For argument's sake, let's say you want to check the information once per day. Something like this will create a list of the first date and last date that a particular port has been open.

your search that gets the open ports with server and port
| bin _time as first_time span=1d
| eval last_time = first_time
| stats count as Open min(first_time) as first_time max(last_time) as last_time by server port

You can go several ways with this.

For instance, you could run it back for a month, and report on any that are open today but have not been open for the preceding 30 days.

| eventstats max(last_time) as max_last_time 
| where first_time = max_last_time

Or, you could run this once over a month or two back, put the results out to a csv or lookup file, and bring that back in every day to check whether the port had been detected previously.

First Run (months)

your search that gets the open ports with server and port
| bin _time as first_time span=1d
| eval last_time = first_time
| stats count as Open min(first_time) as first_time max(last_time) as last_time by server port
| outputcsv mylookup.csv

Later runs (one day)

your search that gets the open ports with server and port
| bin _time as first_time span=1d
| eval last_time = first_time
| inputcsv append=t mylookup.csv
| stats count as Open min(first_time) as first_time max(last_time) as last_time by server port
| outputcsv append=f mylookup.csv
| eventstats max(last_time) as max_last_time 
| where first_time = max_last_time
0 Karma

heathramos
Path Finder

servers meaning Windows servers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...