Splunk Search

Search query

x3ncrypt
Loves-to-Learn

I want to be able to perform a search across a list of internal IPs making http/https GET and POST requests to external sources AFTER or at the SAME TIME a specific external IP is making inbound connection attempts of any kind to them.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please can you share (anonymised) sample events of both outbound and inbound connection attempts?

0 Karma