How to achieve IP scanners scanning many IPs on a single port usecase?


I'm trying to work on the IP scanners scanning many IPs on a single port usecase on splunk 
index=firewall sourcetype="firewall_cloud" dest_port="   "
| stats count by src_ip,dest_port
| where count >3

I'm not sure which dest_port we need to use over here or we need to take the src_port  if needed pls edit the search 

Labels (4)
Tags (1)
0 Karma


Hi @AL3Z,

Please try below, it will show you any scanner host that scans many destination IP addresses for only one port.

index=firewall sourcetype="firewall_cloud" dest_port="*"
| stats dc(dest_ip) as dest_count by src_ip dest_port
| where dest_count >3
If this reply helps you an upvote is appreciated.
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...