Detecting network and port scanning using SPL?

[balu1211]

Hi, 

Could anyone help me with this use case as I'm trying to figure out my alert logic scanner use case scanning many ips on many ports

[gcusello]

Hi @balu1211,

you can find the search and all the information on the requested data sources about this Use Case in the Splunk Security Essentials App (https://splunkbase.splunk.com/app/3435).

Ciao.

Giuseppe

[balu1211]

Hi @gcusello 

Can you make a search out of it, scanning many scr_ip and many dest_ports 

Thanks

[gcusello · Accepted solution]

Hi @balu1211 ,

the easiest solution is to use the search that you can find in this app at [Content > Security Content] opening the Use Case "Basic Scanning", in this way you can find this search (and others):

index=* ( (tag=network tag=communicate) OR sourcetype=zscalernss-fw OR sourcetype=pan*traffic OR sourcetype=opsec OR sourcetype=cisco:asa) earliest=-1h 
| stats dc(dest_port) as num_dest_port dc(dest_ip) as num_dest_ip by src_ip 
| where num_dest_port > 1000 OR num_dest_ip > 1000

but it depends on the data you have and how they are parsed and normalized.

So to a void to make this analysis by chat (that's very difficoult), using this app, you can also check if you have all the data you need for this Use Case and if they are correctly parsed and normalized.

Anyway, you can adapt the above search to your data: e.g. I don't know if you tagged your data, if not, you have to modify the main search for your data.

Ciao.

Giuseppe