Splunk Search

identify scanner and malicious domain


For example, My ip is, I want to identify what are the domains sent me the most number of packets (most frequently), what will be the query look like?

I want to know the domain who sent me the most number of traffics, what would be the query look like?

I want to know the vulnerability scanner the malicious domain is using for reconaissance, which filed I can get info from splunk?


Labels (1)
0 Karma


We can't answer your questions without knowing what data you have indexed in Splunk.  Obviously, if you don't have network traffic data then no query can help you.  If you do have network traffic data then the exact query will depend on how the tool that reported that data chose to format it.  See the Splunk Security Essentials app for examples.

I know of no way to determine which vulnerability scanner a remote site is using.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...