Splunk Search

How to write splunk query for Horizontal and Vertical port scan

nilesh1
New Member

Horizontal Scan: 

External scan against a group of IPs for a single port

 

Vertical Scan: 

External Single IP being scan against multiple port. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What events are you dealing with? Please share an anonymised sample selection.

What do your expected results look like?

What have you tried so far?

0 Karma

nilesh1
New Member

I'm dealing with Cisco firewall events.  

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I see that you are new here.  But this is a Splunk forum.  Very few people will know what Cisco firewall events entail.  In fact, Cisco firewall can also have multiple forms.  @ITWhisperer is asking you to post sample (anonymized) or mock data.  You can use raw events, or field tables. You should also illustrate desired results.  Additionally, explain very clearly which part of the data will lead to your desired result and how.  In short, you need to explain how to get your desired results WITHOUT Splunk.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...