Hello,
I'm pretty new to SPLUNK and I'm looking for help trying to find ASA open connections between two endpoints.
Most connections I search for have a 'Built' action and then some time after a corresponding 'teardown' action. I'm looking for those connections that have the 'Built' action but not the 'teardown' action.
The basic search I have pulls down all of the connections between the two:.
index="cisco" src_ip="10.55.45.12" dest_ip="10.65.45.20" dest_port=445
Is there a way to expand this search to find these open connections based on the absence of a teardown?
Is there a way to
I've tweaked my answer to only look for allowed and teardown actions and then leave only those sessions with the most recent action of "allowed".
Cool, thanks. That seems to have done the trick
Here's one way to do that.
index="cisco" src_ip="10.55.45.12" dest_ip="10.65.45.20" dest_port=445
| dedup session,action
| where action="built"
It assumes there is a field called "session" that uniquely identifies a connection between the two points. Change that to match whatever you have in your data.
Thanks for the response but no joy unfortunately.
It's still bringing up the thousands of results with the allowed action (I mistakenly called it built earlier) , and not showing just the few that only had the allowed action and not a corresponding teardown.
The allowed and teardown options do share a field called 'session_id' which is a long number
I've tweaked my answer to only look for allowed and teardown actions and then leave only those sessions with the most recent action of "allowed".