Hi all,
From a scan report of Qualys, I will get IP and its PORT, TCP_PORT, UDP_PORT. Now when the scan is done after a week, if there is any change in PORT or TCP_PORT or UDP_PORT values, an alert should be triggered. Is there a way of comparing the two results?
for Example:
index="abc" IP=10.22.23.3 | table LAST_SCAN_DATETIME, PORT, TCP_PORT, UDP_PORT
IP=10.22.23.3
LAST_SCAN_DATETIME
2016-06-05T06:32:42Z , PORT - 8808, 2022. TCP_PORT-135 UDP_PORT-123
2016-05-08T06:52:25Z PORT - 8808. TCP_PORT-135 UDP_PORT-123
A new port is added on 2016-06-05T06:32:42Z. How can I create an alert if there is any change in the values of these three fields?
Do you only want an alert if the last two scans are different?
If so try this:
index="abc" IP=10.22.23.3 | head 2 | table PORT | transpose | where 'row 1'!='row 2'
For 3 or more past events, this solution becomes more difficult:
index="abc" IP=10.22.23.3 | head 3 | table PORT | transpose | where 'row 1'!='row 2' OR 'row 1'!='row 3' OR 'row 2'!='row 3'
Try this
index="abc" IP=10.22.23.3 | timechat span=1d dc(PORT) as Port dc(TCP_PORT) as TCP dc(UDP_PORT) as UDP | delta Port | delta TCP | delta UDP | addtotals | where Total!=0
Do you only want an alert if the last two scans are different?
If so try this:
index="abc" IP=10.22.23.3 | head 2 | table PORT | transpose | where 'row 1'!='row 2'
For 3 or more past events, this solution becomes more difficult:
index="abc" IP=10.22.23.3 | head 3 | table PORT | transpose | where 'row 1'!='row 2' OR 'row 1'!='row 3' OR 'row 2'!='row 3'
Thanks! Yes, i want an alert based on the last scan, But here i have 100+ of IP's and can i use more attributes PORT, TCP_PORT and UDP_PORT.