From a scan report of Qualys, I will get IP and its PORT, TCPPORT, UDPPORT. Now when the scan is done after a week, if there is any change in PORT or TCPPORT or UDPPORT values, an alert should be triggered. Is there a way of comparing the two results?
index="abc" IP=10.22.23.3 | table LAST_SCAN_DATETIME, PORT, TCP_PORT, UDP_PORT IP=10.22.23.3 LAST_SCAN_DATETIME 2016-06-05T06:32:42Z , PORT - 8808, 2022. TCP_PORT-135 UDP_PORT-123 2016-05-08T06:52:25Z PORT - 8808. TCP_PORT-135 UDP_PORT-123
A new port is added on 2016-06-05T06:32:42Z. How can I create an alert if there is any change in the values of these three fields?
Do you only want an alert if the last two scans are different?
If so try this:
index="abc" IP=10.22.23.3 | head 2 | table PORT | transpose | where 'row 1'!='row 2'
For 3 or more past events, this solution becomes more difficult:
index="abc" IP=10.22.23.3 | head 3 | table PORT | transpose | where 'row 1'!='row 2' OR 'row 1'!='row 3' OR 'row 2'!='row 3'
Thanks! Yes, i want an alert based on the last scan, But here i have 100+ of IP's and can i use more attributes PORT, TCPPORT and UDPPORT.
index="abc" IP=10.22.23.3 | timechat span=1d dc(PORT) as Port dc(TCP_PORT) as TCP dc(UDP_PORT) as UDP | delta Port | delta TCP | delta UDP | addtotals | where Total!=0