How to black list all the ports except the approved ports using interesting ports list in splunk enterprise security?

[prammod123]

I would like to black list (get alert) for all the ports excepting the approved port list using interesting port list.

Please advise on the available options to achieve this.

[Azeemering]

Since the interesting ports list in ES is stored in a lookup you can build a SPL query alert based on:

    |  inputlookup interesting_ports.csv

use the fields is_prohibited=true I guess.

[prammod123]

I think re articulating the question would help to get the nearest answer.. I want to mark every other port as prohibited except the approved ports in my environment.

[Azeemering]

Same counts for that I guess. You can modify the interesting_ports.csv to match your needs.