How to search for IP addresses that have been hit on more than one port within a short period of time?

[Securitas]

I have been trying to figure out on how to do a search for IP addresses that were hit on more than one Port in a short period of time.

[MuS · Accepted solution]

Hi Securitas,

all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port:

time=10:01 ip=1.1.1.1 port=22
time=10:02 ip=1.1.1.1 port=23
time=10:02 ip=2.2.2.2 port=23
time=10:02 ip=2.2.2.2 port=21
time=10:03 ip=1.1.1.1 port=80

Running this search will return connects to more than one port by time:

sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1

If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time value):

sourcetype="ip_port" | addinfo | eval _time=_indextime 
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1

If you want to see which IP's got connection to the same port at the same time use this:

sourcetype="ip_port" | chart values(port) AS ports over time by ip

Hope this helps to get you started ...

cheers, MuS

[Securitas]

Thanks. That's within the confines of what I was looking for.

Cheers Mate.