I have NMAP data in Splunk that reports on open ports associated with a list of IP addresses. I'd like to create a lookup that I can then use to query against and alert/report on in a new query that runs every night. Any suggestions on how to structure the lookup and/or the resulting query?
I understand that you have data like in the below and this data is updated daily. What you wanted to do is create some alert/report with historical data or daily data. So lets say your data is like on
Monday
IP Port
10.230.32.12 443
10.10.10.10 80
Tuesday
IP Port
10.11.12.13 1139
23.45.125.243 139
Firstly you should create and schedule a query that Runs every night at 00:00 and search for Yesterday
.
In your query you should write the neccesary data to your outputlookup for using in the future
index=nmap_data |table _time,IP,port| outputlookup portscan_list append=t
Now you have outputlookup like
Time IP Port
Monday 10.230.32.12 445
Monday 10.10.10.10 80
Monday 3.24.31.234 25
Tuesday 10.11.12.13 1139
Tuesday 23.45.125.243 139
Now you can create alert from this outputlookup according to your need. Lets say you guys dont want to have open ports on default SMB port since it has some high risks. Then you can set an alert like
|inputlookup portscan_list | search (port=139 OR port=445) and you can Schedule this to run daily/weekly/monthly as you need.