How can I use Splunk to monitor network ports on servers?

[heathramos]

I need to be able to generate an email alert when a new port is opened on a server.

what is the best way to do this?

The only thing I can think of is to create a lookup table with hostname and open ports and maybe reference my nessus scans for open ports (since the nessus scan data is already in my splunk indexes).

is there a better/easier way?

[DalJeanis]

The general statement is that you can detect anything in splunk that is present in splunk. So, first, you have to get records into splunk that contain the information about either (A) which ports are open, or (B) which ports are accessed. B is late to the party, so you probably want A, and so your nessus scans are probably the right way to go.

For argument's sake, let's say you want to check the information once per day. Something like this will create a list of the first date and last date that a particular port has been open.

your search that gets the open ports with server and port
| bin _time as first_time span=1d
| eval last_time = first_time
| stats count as Open min(first_time) as first_time max(last_time) as last_time by server port

You can go several ways with this.

For instance, you could run it back for a month, and report on any that are open today but have not been open for the preceding 30 days.

| eventstats max(last_time) as max_last_time 
| where first_time = max_last_time

Or, you could run this once over a month or two back, put the results out to a csv or lookup file, and bring that back in every day to check whether the port had been detected previously.

First Run (months)

your search that gets the open ports with server and port
| bin _time as first_time span=1d
| eval last_time = first_time
| stats count as Open min(first_time) as first_time max(last_time) as last_time by server port
| outputcsv mylookup.csv

Later runs (one day)

your search that gets the open ports with server and port
| bin _time as first_time span=1d
| eval last_time = first_time
| inputcsv append=t mylookup.csv
| stats count as Open min(first_time) as first_time max(last_time) as last_time by server port
| outputcsv append=f mylookup.csv
| eventstats max(last_time) as max_last_time 
| where first_time = max_last_time

[heathramos]

servers meaning Windows servers