How to use a lookup table to identify new open ports based on source IP

[khansonveracode]

I have NMAP data in Splunk that reports on open ports associated with a list of IP addresses. I'd like to create a lookup that I can then use to query against and alert/report on in a new query that runs every night. Any suggestions on how to structure the lookup and/or the resulting query?

[halisc]

I understand that you have data like in the below and this data is updated daily. What you wanted to do is create some alert/report with historical data or daily data. So lets say your data is like on

Monday
IP Port
10.230.32.12 443
10.10.10.10 80

3.24.31.234 25

Tuesday
IP Port
10.11.12.13 1139
23.45.125.243 139

Firstly you should create and schedule a query that Runs every night at 00:00 and search for Yesterday.
In your query you should write the neccesary data to your outputlookup for using in the future
index=nmap_data |table _time,IP,port| outputlookup portscan_list append=t

Now you have outputlookup like

Time IP Port
Monday 10.230.32.12 445
Monday 10.10.10.10 80
Monday 3.24.31.234 25
Tuesday 10.11.12.13 1139
Tuesday 23.45.125.243 139

Now you can create alert from this outputlookup according to your need. Lets say you guys dont want to have open ports on default SMB port since it has some high risks. Then you can set an alert like

|inputlookup portscan_list | search (port=139 OR port=445) and you can Schedule this to run daily/weekly/monthly as you need.