My goal is to look at firewall data and pull the top 10 Blocked IPs along with the incoming ports they were hitting. So I want the IP, then all ports on that IP, and the count of the ports. Here is what I have so far
host=10.2.2.1 filterlog [search host=10.2.2.1 filterlog | top Source_IP | table Source_IP] | stats values(Source_IP) as IP, values(Destination_Port) as Ports by Source_IP | table IP, Ports
It works for IP with a list of ports but I cannot get a count of the ports. Here is what it spits out
IP Port
10.2.2.183 443
80
993
10.2.2.22 443
80
112.138.14.244 51413
119.247.54.238 51413
120.75.230.2 51413
178.93.32.248 51413
180.127.81.72 51413
36.228.5.180 51413
And I want something more like this
IP Port Count
10.2.2.183 443 22
80 25
993 148
10.2.2.22 443 7486
80 454545
112.138.14.244 51413 14
119.247.54.238 51413 54
120.75.230.2 51413 11
178.93.32.248 51413 1
180.127.81.72 51413 45
36.228.5.180 51413 454
... View more
