Demo
· synthetic data environment — all IPs and findings are fictitious
Product
Book a call
ThreatDB
Dashboard
External IPs
Internal IPs
Queries
Whitelist
Runs
Trigger Pipeline
Edit Query: 02-Lange_Connections
Name (unique)
IP column name
Enabled
ESQL
FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 48 hours AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS max_dur_h = MAX(event.duration / 3600000000000.0) BY src = source.ip, dst = destination.ip, port = destination.port | WHERE max_dur_h > 5 | SORT max_dur_h DESC
Save Changes
Cancel