I have been trying to figure out on how to do a search for IP addresses that were hit on more than one Port in a short period of time.
all based on assumption, because you did not provide sample data and the search you're using - so I'll use a basic run everywhere example to construct an event and a search. I indexed a file containing this data as sourcetype=ip_port:
time=10:01 ip=126.96.36.199 port=22
time=10:02 ip=188.8.131.52 port=23
time=10:02 ip=184.108.40.206 port=23
time=10:02 ip=220.127.116.11 port=21
time=10:03 ip=18.104.22.168 port=80
Running this search will return connects to more than one port by time:
sourcetype="ip_port" | stats count(port) AS Port_count by time, ip | where Port_count>1
If you want to check over 2 minutes use this search (Note: the first line is only needed to construct a useable _time value):
sourcetype="ip_port" | addinfo | eval _time=_indextime
| bin _time span=2min | stats count(port) AS Port_count by _time, ip | where Port_count>1
If you want to see which IP's got connection to the same port at the same time use this:
sourcetype="ip_port" | chart values(port) AS ports over time by ip
Hope this helps to get you started ...
View solution in original post
Thanks. That's within the confines of what I was looking for.