count_of_unique_ips_connecting_to_ports.yml

name: Count of Unique IPs Connecting to Ports
id: 9f3bae5a-9fe3-49df-8c84-5edc51d84b7f
version: 1
date: '2017-09-13'
author: David Dorsey, Splunk
type: Baseline
datamodel:
- Network_Traffic
description: The search counts the number of times a connection was observed to each
  destination port, and the number of unique source IPs connecting to them.
search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts
  from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
  | sort - count'
how_to_implement: To successfully implement this search, you must be ingesting network
  traffic, and populating the Network_Traffic data model.
known_false_positives: none
references: []
tags:
  analytic_story:
  - Prohibited Traffic Allowed or Protocol Mismatch
  - Ransomware
  - Command And Control
  detections:
  - Prohibited Network Traffic Allowed
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Traffic.dest_port
  - All_Traffic.src
  security_domain: network