Security

Query for any suspicious IP address

ephrem3232
Explorer

I'm looking for a splunk query for any suspicious IP address associated with an IP range that was already blocked in the top ten.

Thank you,

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Questions to help clarify the problem.
What do you consider a "suspicious IP address"?
If the IP range was already blocked then how will an IP address in that range appear in the top ten?
---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!