In Splunk Enterprise Security, how do you use a regular expression to find destination port numbers?

[kokanne]

I want to make a usecase that will detect the usage of several destination port numbers. For this, I think it's easiest to use a regular expression. But I'm not sure. I'm also having trouble implementing a regular expression into my query. I've never worked with them before.

Please evaluate the following information and tell me what you think is best to develop the query.

1. The usecase must be easy to add or remove any port numbers from, in case we want to detect other things.
2. The usecase must be able to detect ranges of port numbers when indicated.

Now, for what I've tried is the following:

index=network
| regex dest_port>="688[1-9]"

But this doesn't work. I will use datamodel later.
The range for the ports is:

• 6881 to 6889
• 6969

In addition to those ports, we also want it to alert when it finds the following strings in the field app_category:

• app_category field contains tracker
• app_category field contains torrent

Any help would be much appreciated. I think someone with a lot of regular expression experience will be able to make the query easily, I've been stuck on it for hours sadly and I would love some help.

Thanks!

[woodcock]

Like this (breaks down at 1000 values):

index=network [ |makeresults | eval port=mvappend(mvrange(6881, 6889, 1), "6969") | format ]

[woodcock]

Do NOT use regex because it does not map-reduce and you will pull all the values out only to throw them away and your search will take 1000x longer than the way that I just showed you.

[renjith_nair]

@kokanne ,

For the dest_port, try

index=network | regex dest_port="688[1-9]|6969" 

and for the app_category, you could search with (app_category="*tracker*" OR app_category="*torrent*")

Or if both conditions are to be matched , try

index=network |where (match(dest_port,"688[1-9]|6969") OR match(app_category,"tracker|torrent"))