investigate_network_traffic_from_src_ip.yml

name: Investigate Network Traffic From src ip
id: 9df9ca9c-a02b-4f48-9eba-0bac55179050
version: 1
date: '2018-06-15'
author: David Dorsey, Splunk
type: Investigation
datamodel:
- Network_Traffic
description: This search allows you to find all the network traffic from a specific
  IP address.
search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$'
how_to_implement: To successfully implement this search, you must be ingesting your
  web-traffic logs and populating the web data model.
known_false_positives: ''
references: []
tags:
  analytic_story:
  - ColdRoot MacOS RAT
  cve:
  - CVE-2018-11409
  product:
  - Splunk Phantom
  required_fields:
  - _time
  - src_ip
  security_domain: network