Splunk Enterprise Security

How to Write query for TCP port activity in splunk ES

shivarpith
Path Finder

Hi,

We are trying to analyze traffic on TCP ports both inbound and outbound in Splunk ES excluding the ports 80,443

0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Hi shivarpith, something like this will show you what the Network Traffic Datamodel is seeing:

| datamodel Network_Traffic All_Traffic search | search All_Traffic.src_port!=80 All_Traffic.src_port!=443 All_Traffic.dest_port!=80 All_Traffic.dest_port!=443

This will give you the raw events.

Please let me know if this helps!

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

Hi shivarpith, something like this will show you what the Network Traffic Datamodel is seeing:

| datamodel Network_Traffic All_Traffic search | search All_Traffic.src_port!=80 All_Traffic.src_port!=443 All_Traffic.dest_port!=80 All_Traffic.dest_port!=443

This will give you the raw events.

Please let me know if this helps!

View solution in original post

0 Karma

MuhammadAbdelAa
New Member

its works for me , big Thanks 🙂

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!