Splunk Search
Highlighted

How to use a lookup table to identify new open ports based on source IP

New Member

I have NMAP data in Splunk that reports on open ports associated with a list of IP addresses. I'd like to create a lookup that I can then use to query against and alert/report on in a new query that runs every night. Any suggestions on how to structure the lookup and/or the resulting query?

0 Karma
Highlighted

Re: How to use a lookup table to identify new open ports based on source IP

New Member

I understand that you have data like in the below and this data is updated daily. What you wanted to do is create some alert/report with historical data or daily data. So lets say your data is like on

Monday
IP Port
10.230.32.12 443
10.10.10.10 80

3.24.31.234 25

Tuesday
IP Port
10.11.12.13 1139
23.45.125.243 139

Firstly you should create and schedule a query that Runs every night at 00:00 and search for Yesterday.
In your query you should write the neccesary data to your outputlookup for using in the future
index=nmapdata |table _time,IP,port| outputlookup portscanlist append=t

Now you have outputlookup like

Time IP Port
Monday 10.230.32.12 445
Monday 10.10.10.10 80
Monday 3.24.31.234 25
Tuesday 10.11.12.13 1139
Tuesday 23.45.125.243 139

Now you can create alert from this outputlookup according to your need. Lets say you guys dont want to have open ports on default SMB port since it has some high risks. Then you can set an alert like

|inputlookup portscan_list | search (port=139 OR port=445) and you can Schedule this to run daily/weekly/monthly as you need.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.