Splunk Enterprise Security

How to black list all the ports except the approved ports using interesting ports list in splunk enterprise security?

prammod123
Explorer

I would like to black list (get alert) for all the ports excepting the approved port list using interesting port list.

Please advise on the available options to achieve this.

0 Karma

Azeemering
Builder

Since the interesting ports list in ES is stored in a lookup you can build a SPL query alert based on:

    |  inputlookup interesting_ports.csv

use the fields is_prohibited=true I guess.

alt text

0 Karma

prammod123
Explorer

I think re articulating the question would help to get the nearest answer.. I want to mark every other port as prohibited except the approved ports in my environment.

0 Karma

Azeemering
Builder

Same counts for that I guess. You can modify the interesting_ports.csv to match your needs.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!