Splunk Search

Sniffing Ports Up/Down -- IFconfig?

ddecker03
Loves-to-Learn Everything

Looking for a way to monitor sniffing ports on a sensor.  Each port is tied to a different part of the system and would like a dashboard notification UP/DOWN if traffic has not been rcvd say in 1-5 minutes.  

i thought about doing IFCONFIG, but I think I made it to complicated by using grep to narrow down just the RX/TX information.   

ifconfig | egrep -e ^eth | grep -v "inet\|UP"  which does a pretty good job for CLI output.   

I tried installing the App *Nix but cant really get it to work.  

I am using a Splunk server, and the "sensors" are a dffierant server which has the UFW.  

 

Thanks

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Consider putting your CLI command into a shell script and invoking the shell script as a Splunk scripted input every 5 minutes.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...