author: David Dorsey, Splunk
date: '2018-06-15'
description: This search searches for all web activity from a specific host. During
  an investigation, it is important to profile web activity to characterize user or
  host activity.
how_to_implement: To successfully implement this search, you must be ingesting your
  web traffic and populating the web data model.
id: 2f5b960b-71df-49c0-affc-74992ce60e45
inputs:
- src_ip
name: Investigate Web Activity From src ip
search: '| from datamodel Web.Web | search src=$src_ip$'
tags:
  analytic_story:
  - ColdRoot MacOS RAT
  - Dynamic DNS
  - Splunk Enterprise Vulnerability CVE-2018-11409
  product:
  - Splunk Phantom
type: response
version: 1
