Query - Find all ip visiting multiple differents servers

Elastic Stack Elasticsearch
1

Hello guys,

I'm new here and I discovered the ELK stack a few days ago. I managed to parse all my webserver logs and now I'm having fun with elasticSearch to perform some research.

Right now I have a query idea but I really don't now how I can do it, mostly because I'm not famililiar with the ElasticSearch vocabolary so it's difficult for me to search the right stuff.

In my logs and ElasticSearch DB, I have a field for the visitor IP address and another field for the webserver name. I have multiple servers and I want to find all IPs that visit at least 2 websites hosted on differents servers.

The idea is to detect all IP accessing different servers within a reasonable period of time, I think it's interesting in a security point of view because I'm pretty sure I'll find a lot of servers scans.

Is it possible to do such things with ES ? How can I do that ? (how is this called at least ? like I said, i'm not familiar with the vocabular of ES yet).

Thank in advance,
Have a great day,
Alexis

2

have you try range query? https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html

3

I think you would like to look up the following concepts:

  • period of time: range filter
  • break down by ip: terms aggregation
  • count unique servers: cardinality aggregation
1 Like