Demo
· synthetic data environment — all IPs and findings are fictitious
Product
Book a call
ThreatDB
Dashboard
External IPs
Internal IPs
Queries
Whitelist
Runs
Trigger Pipeline
Edit Query: 09-ICMP_Beacons
Name (unique)
IP column name
Enabled
ESQL
FROM logs-zeek.connection* | WHERE @timestamp > NOW() - 24 hours AND network.transport == "icmp" AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8") | STATS conn_count = COUNT(*) BY src = source.ip, dst = destination.ip | WHERE conn_count >= 100 | SORT conn_count DESC
Save Changes
Cancel