Scan Behavior: How to query the trigger for the same period for three consecutive days?

[Dustem]

hi guys, I want to detect that more than 10 different ports of the same host are sniffed and scanned every 15 minutes and triggered 5 times in a row, then the alarm; If the same time period is triggered for three consecutive days, the alarm is triggered.
The current SPL:

index="xx"

| bin _time span=15m

| stats dc(dest_port) as dc_ports by _time src_ip dest_ip

| where dc_ports > 10
| streamstats count as consecutive_triggers by src_ip dest_ip reset_on_change=Ture

| where consecutive_triggers>=5

Next, I don't know how to query the trigger for the same period for three consecutive days.

[gcusello]

Hi @Dustem,

you could save the results of you search in a summary index (using the collect command), then execute the alert on the summary index and trigger it if you have more than 3 results.

Ciao.

Giuseppe

[Dustem]

Hello gcusello,

Sorry, I forgot to reply. I rewrote SPL myself to complete the requirements, thanks for your help.

[gcusello]

Hi @Dustem ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[Dustem]

Hi gcusello,

How do I set it to trigger at the same time in three days?

[gcusello]

Hi @Dustem,

you schedule your search every day (using the last day as time frame) and you save the results in a summary index, one event every day.

Then you can schedule a search on the summary index, using three days as time frame.

Ciao.

Giuseppe

[Dustem]

Can I do this by writing SPL?

[gcusello]

Hi @Dustem,

yes, you should create an alert, scheduled e.g. one time  day like the following:

index="xx"
| bin _time span=15m
| stats dc(dest_port) as dc_ports by _time src_ip dest_ip
| where dc_ports > 10
| streamstats count as consecutive_triggers by src_ip dest_ip reset_on_change=Ture
| where consecutive_triggers>=5
| collect index=my_summary

that triggers the conditons you need and saves results in a summary index.

then if the alert is named "scan"

you can search on the summary for the search_name="scan" in the last three days:

index=my_summary search_name=scan
| stats count BY src_ip dest_ip
| where count>5

Obviously you have to adapt my approach to your Use case.

Ciao.

Giuseppe