Demo
· synthetic data environment — all IPs and findings are fictitious
Product
Book a call
ThreatDB
Dashboard
External IPs
Internal IPs
Queries
Whitelist
Runs
Trigger Pipeline
Edit Query: 01-Starke_Beacons
Name (unique)
IP column name
Enabled
ESQL
FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 24 hours AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS conn_count = COUNT(*), first_ts = MIN(@timestamp), last_ts = MAX(@timestamp), avg_src_bytes = AVG(source.bytes), stddev_src_bytes = std_dev(source.bytes) BY src = source.ip, dst = destination.ip, port = destination.port | EVAL duration_min = DATE_DIFF("minutes", first_ts, last_ts), rate_per_min = conn_count / (duration_min + 1.0), cv_bytes = stddev_src_bytes / (avg_src_bytes + 1) | WHERE conn_count >= 70 AND rate_per_min >= 0.95 AND rate_per_min <= 2.2 AND avg_src_bytes >= 80 AND avg_src_bytes <= 5000 AND cv_bytes <= 0.28 | SORT cv_bytes ASC, conn_count DESC
Save Changes
Cancel