Splunk Search

Search based on different requests?

karatyman
Engager

Hello,

I'm trying to create a search that will allow me to search a subnet for requests made from a single source IP to more than X amount of destination IPS.

for example,

if 10.10.10.10 sends traffic over port 445 to all the devices in the range 10.10.10.11- 10.10.10.50 therefore 40 different Destinations
and 10.10.10.20 sent traffic over port 445 to 10.10.10.70 and 10.10.10.66 therefore 2 different destinations.

I wouldn't want to see the traffic sent from 10.10.10.20 as the total number of destination IPs is too low.

Is it possible to do something like:

src_ip=10.10.10.0/24 dest_port=445 dest_ip_count>=10

src_ip=10.10.10.0/24 -- Range of IPs I want to search for traffic on
dest_port=445 -- Port the traffic is being sent on
dest_ip_count>=10 Theoretical parameter that filters out source IPs not sending traffic to 10+ different devices

Thanks

Tags (1)
0 Karma

lguinn2
Legend

You can do exactly what you asked, and the syntax is not that far from your description!

src_ip=10.10.10.0/24 dest_port=445
| stats dc(dest_ip) as unique_dest_ips by src_ip
| where unique_dest_ips > 10

The dc function of the stats command counts the number of unique occurrences of a field. In this case, it is counting the number of unique destination ips used by each source ip. Note that Splunk accepts CIDR notation in the search, no problem.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...