Demo
· synthetic data environment — all IPs and findings are fictitious
Product
Book a call
ThreatDB
Dashboard
External IPs
Internal IPs
Queries
Whitelist
Runs
Trigger Pipeline
Edit Query: 05-Beacon_30d_3h_n8
Name (unique)
IP column name
Enabled
ESQL
FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 30 days AND network.transport == "tcp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") AND (source.bytes IS NULL OR source.bytes <= 5000) | STATS conn_count = COUNT(*) BY src = source.ip, dst = destination.ip, day = DATE_TRUNC("24 hours", @timestamp) | WHERE conn_count >= 6 AND conn_count <= 10 | STATS active_days = COUNT(*) BY src, dst | WHERE active_days >= 25
Save Changes
Cancel