Splunk Search

5 or more different destination IP, one IDS attack name, all in 1h query

PiotrAp
Explorer

Hi,

I'm trying to create a query which will display events matching following conditions: 5 or more different destination IP, one IDS attack name, all in 1h.

I tried to use following:

index=ids
| streamstats count time_window=1h by dest_ip attack_name
| where count (attack_name=1 AND dest_ip>=5)

but it is not accepted by Splunk so I presume it has to be written differently. Could somebody help me please?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If there are events from 5 different IP addresses with the same attack name then a count by dest_ip and attack_name will produce 5 events with a count of 1.  Very likely not what you're looking for.  Instead, count the number of IP address for each attack name and keep the results where the count is at least 5.

index=ids
| streamstats distinct_count(dest_ip) as count time_window=1h by attack_name
| where count >= 5
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If there are events from 5 different IP addresses with the same attack name then a count by dest_ip and attack_name will produce 5 events with a count of 1.  Very likely not what you're looking for.  Instead, count the number of IP address for each attack name and keep the results where the count is at least 5.

index=ids
| streamstats distinct_count(dest_ip) as count time_window=1h by attack_name
| where count >= 5
---
If this reply helps you, Karma would be appreciated.

PiotrAp
Explorer

This is exactly what I'm looking for. Many thanks for your help!

Tags (1)
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...