Splunk Search

How to use a lookup table to identify new open ports based on source IP

New Member

I have NMAP data in Splunk that reports on open ports associated with a list of IP addresses. I'd like to create a lookup that I can then use to query against and alert/report on in a new query that runs every night. Any suggestions on how to structure the lookup and/or the resulting query?

0 Karma

New Member

I understand that you have data like in the below and this data is updated daily. What you wanted to do is create some alert/report with historical data or daily data. So lets say your data is like on

IP Port 443 80 25

IP Port 1139 139

Firstly you should create and schedule a query that Runs every night at 00:00 and search for Yesterday.
In your query you should write the neccesary data to your outputlookup for using in the future
index=nmap_data |table _time,IP,port| outputlookup portscan_list append=t

Now you have outputlookup like

Time IP Port
Monday 445
Monday 80
Monday 25
Tuesday 1139
Tuesday 139

Now you can create alert from this outputlookup according to your need. Lets say you guys dont want to have open ports on default SMB port since it has some high risks. Then you can set an alert like

|inputlookup portscan_list | search (port=139 OR port=445) and you can Schedule this to run daily/weekly/monthly as you need.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...