Queries

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 24 hours AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS conn_count = COUNT(*), first_ts = MIN(@timestamp), last_ts = MAX(@timestamp), avg_src_bytes = AVG(source.bytes), stddev_src_bytes = std_dev(source.bytes) BY src = source.ip, dst = destination.ip, port = destination.port | EVAL duration_min = DATE_DIFF("minutes", first_ts, last_ts), rate_per_min = conn_count / (duration_min + 1.0), cv_bytes = stddev_src_bytes / (avg_src_bytes + 1) | WHERE conn_count >= 70 AND rate_per_min >= 0.95 AND rate_per_min <= 2.2 AND avg_src_bytes >= 80 AND avg_src_bytes <= 5000 AND cv_bytes <= 0.28 | SORT cv_bytes ASC, conn_count DESC

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 48 hours AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS max_dur_h = MAX(event.duration / 3600000000000.0) BY src = source.ip, dst = destination.ip, port = destination.port | WHERE max_dur_h > 5 | SORT max_dur_h DESC

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 24 hours AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS conn_count = COUNT(*), avg_src_bytes = AVG(source.bytes) BY src = source.ip, dst = destination.ip, port = destination.port | WHERE conn_count >= 80 AND avg_src_bytes >= 50 AND avg_src_bytes <= 3000 | SORT conn_count DESC

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 30 days AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") AND (source.bytes IS NULL OR source.bytes <= 5000) | STATS conn_count = COUNT(*) BY src = source.ip, dst = destination.ip, day = DATE_TRUNC("24 hours", @timestamp) | WHERE conn_count >= 10 AND conn_count <= 14 | STATS active_days = COUNT(*) BY src, dst | WHERE active_days >= 25

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 30 days AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") AND (source.bytes IS NULL OR source.bytes <= 5000) | STATS conn_count = COUNT(*) BY src = source.ip, dst = destination.ip, day = DATE_TRUNC("24 hours", @timestamp) | WHERE conn_count >= 6 AND conn_count <= 10 | STATS active_days = COUNT(*) BY src, dst | WHERE active_days >= 25

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 30 days AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") AND (source.bytes IS NULL OR source.bytes <= 5000) | STATS conn_count = COUNT(*) BY src = source.ip, dst = destination.ip, day = DATE_TRUNC("24 hours", @timestamp) | WHERE conn_count >= 4 AND conn_count <= 8 | STATS active_days = COUNT(*) BY src, dst | WHERE active_days >= 25

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 30 days AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") AND (source.bytes IS NULL OR source.bytes <= 5000) | STATS conn_count = COUNT(*) BY src = source.ip, dst = destination.ip, day = DATE_TRUNC("24 hours", @timestamp) | WHERE conn_count >= 2 AND conn_count <= 6 | STATS active_days = COUNT(*) BY src, dst | WHERE active_days >= 25

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 24 hours AND network.transport == "udp" AND (source.bytes IS NULL OR source.bytes <= 5000) AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8", "224.0.0.0/4", "ff00::/8", "169.254.0.0/16", "fe80::/10", "127.0.0.0/8", "255.255.255.255/32") | STATS conn_count = COUNT(*), first_ts = MIN(@timestamp), last_ts = MAX(@timestamp), avg_src_bytes = AVG(source.bytes), stddev_src_bytes = std_dev(source.bytes) BY src = source.ip, dst = destination.ip, port = destination.port | EVAL duration_min = DATE_DIFF("minutes", first_ts, last_ts), rate_per_min = conn_count / (duration_min + 1.0), cv_bytes = stddev_src_bytes / (avg_src_bytes + 1) | WHERE conn_count >= 50 AND rate_per_min >= 0.05 AND avg_src_bytes <= 5000 AND (cv_bytes IS NULL OR cv_bytes <= 0.35) | SORT conn_count DESC

FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 24 hours AND network.transport == "icmp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS conn_count = COUNT(*) BY src = source.ip, dst = destination.ip | WHERE conn_count >= 100 | SORT conn_count DESC