Splunk Search

identify scanner and malicious domain

cyberfan
Explorer

For example, My ip is 202.101.53.4, I want to identify what are the domains sent me the most number of packets (most frequently), what will be the query look like?

I want to know the domain who sent me the most number of traffics, what would be the query look like?

I want to know the vulnerability scanner the malicious domain is using for reconaissance, which filed I can get info from splunk?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

We can't answer your questions without knowing what data you have indexed in Splunk.  Obviously, if you don't have network traffic data then no query can help you.  If you do have network traffic data then the exact query will depend on how the tool that reported that data chose to format it.  See the Splunk Security Essentials app for examples.

I know of no way to determine which vulnerability scanner a remote site is using.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...