Splunk search query

[Sidmi09]

To obtain "list of suspicious IP addresses that attempt to make an unauthorized web connection having a duration of longer than 1 minute" using Splunk search query?

[ITWhisperer]

What data do you already have ingested and indexed in splunk that might support such a search?

What criteria are you using to determine suspiciousness?

What criteria are you using to determine whether the connection is unauthorised?

Are unauthorised connections of less than a minute to be ignored/unlisted?

[Sidmi09]

Using index=botsv2” in all searches. Could you help with completing some questions asked to be completed!!!

[ITWhisperer]

Can you share some anonymised raw events from your index so we can see what data you are dealing with?