author: David Dorsey, Splunk
date: '2018-06-15'
description: This search allows you to find all the network traffic from a specific
  IP address.
how_to_implement: To successfully implement this search, you must be ingesting your
  web-traffic logs and populating the web data model.
id: 9df9ca9c-a02b-4f48-9eba-0bac55179050
inputs:
- src_ip
name: Investigate Network Traffic From src ip
search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$'
tags:
  analytic_story:
  - ColdRoot MacOS RAT
  - Splunk Enterprise Vulnerability CVE-2018-11409
  product:
  - Splunk Phantom
type: response
version: 1
