Excessive Inbound or Outbound Connections from same Source
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Unusually increased number of inbound or outbound connections originating from or targeting the same source IP
Severity
Trouble
Rule Requirement
Criteria
highly_traffic_abnormal_source_e1: logtype = "*" and IENAME = "Traffic Allowed" | groupby SOURCE_IP limit 10 having count > 100000 | first 1 DEST_IP, DEST_PORT, ACTION select highly_traffic_abnormal_source_e1.SOURCE_IP as SourceIP, highly_traffic_abnormal_source_e1.SOURCE_IP.ACTION as Top_Action, highly_traffic_abnormal_source_e1.SOURCE_IP.DEST_IP as Top_DestinationIP, highly_traffic_abnormal_source_e1.SOURCE_IP.DEST_PORT as Top_Destination_port, count(highly_traffic_abnormal_source_e1.SOURCE_IP)
Detection
Execution Mode
scheduled
Log Sources
Network
