Splunk Enterprise Security

Need connection data for firewall cleanup

rclifford
New Member

Hi Forum,
I am in the process of cleaning up some old rules on our Palo Altos. The custom search function in the firewall is very slow. I would like to leverage our Splunk environment to spped up the data collection. What I am looking for is:
-) who does ip xxx connect to and on what port
-) who connects to ip xxx and on what port
Thank You
Ron

0 Karma

mydog8it
Builder

who does ip xxx connect to and on what port...

   index=Your_index sourcetype="pan:traffic" src_ip="x.x.x.x" | stats count by dest_ip dest_port

who connects to ip xxx and on what port...

   index=Your_index sourcetype="pan:traffic" dest_ip="x.x.x.x" | stats count by src_ip src_port
0 Karma