Splunk Enterprise Security

In Splunk Enterprise Security, how do you use a regular expression to find destination port numbers?

kokanne
Communicator

I want to make a usecase that will detect the usage of several destination port numbers. For this, I think it's easiest to use a regular expression. But I'm not sure. I'm also having trouble implementing a regular expression into my query. I've never worked with them before.

Please evaluate the following information and tell me what you think is best to develop the query.

  1. The usecase must be easy to add or remove any port numbers from, in case we want to detect other things.
  2. The usecase must be able to detect ranges of port numbers when indicated.

Now, for what I've tried is the following:

index=network
| regex dest_port>="688[1-9]"

But this doesn't work. I will use datamodel later.
The range for the ports is:

  • 6881 to 6889
  • 6969

In addition to those ports, we also want it to alert when it finds the following strings in the field app_category:

  • app_category field contains tracker
  • app_category field contains torrent

Any help would be much appreciated. I think someone with a lot of regular expression experience will be able to make the query easily, I've been stuck on it for hours sadly and I would love some help.

Thanks!

0 Karma

woodcock
Esteemed Legend

Like this (breaks down at 1000 values):

index=network [ |makeresults | eval port=mvappend(mvrange(6881, 6889, 1), "6969") | format ]
0 Karma

woodcock
Esteemed Legend

Do NOT use regex because it does not map-reduce and you will pull all the values out only to throw them away and your search will take 1000x longer than the way that I just showed you.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kokanne ,

For the dest_port, try

index=network | regex dest_port="688[1-9]|6969" 

and for the app_category, you could search with (app_category="*tracker*" OR app_category="*torrent*")

Or if both conditions are to be matched , try

index=network |where (match(dest_port,"688[1-9]|6969") OR match(app_category,"tracker|torrent"))
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...