Splunk Search

Splunk query for port scan

dsdeepak
Explorer

Hi All,

I am looking for splunk query to detect vertical and horizontal port scan in the Infra. Any help in this regard will be appreciable. Here is query in layman language.

Vertical Port Scan:

1. External IP performing scan on single system for multiple ports

Horizontal Port Scan:

1.  External IP is scanning multiple systems for querying single port.  

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check out Basic Scanning in the Splunk Security Essentials app.

---
If this reply helps you, Karma would be appreciated.
0 Karma

thambisetty
SplunkTrust
SplunkTrust

you might get so many alerts if you create alert based on static thresholds

Below is the search uses static threshold

vertical:

index=trafficlogs 

| stats dc(dest_port) as dc_dest_port by src, dest

| where dc_dest_port > 10

horizontal:

index=trafficlogs

| stats dc(dest) as dc_dest by src, dest_port

| where dc_dest > 10

10 is threshold here.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...