author: Bhavin Patel, Splunk
date: '2019-04-01'
description: This search will return information about the process associated with
  observed network traffic to a specific destination port from a specific host.
how_to_implement: To successfully implement this search you must be ingesting endpoint
  data that associates processes with network events and populate the Endpoint Datamodel
id: 9925d08f-561e-4faa-8912-e3888a842341
inputs:
- dest_port
- dest
name: Get Process Information For Port Activity
search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as
  lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user
  Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | search dest=$dest$ | join dest type=inner
  [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by
  Ports.process_id Ports.src Ports.dest_port | `drop_dm_object_name(Ports)` | search
  dest_port=$dest_port$ | rename src as dest]'
tags:
  analytic_story:
  - AWS Network ACL Activity
  - Command and Control
  - DHS Report TA18-074A
  - 'Emotet Malware  DHS Report TA18-201A '
  - Hidden Cobra Malware
  - Lateral Movement
  - Prohibited Traffic Allowed or Protocol Mismatch
  - Ransomware
  - SamSam Ransomware
  - Suspicious AWS Traffic
  - Use of Cleartext Protocols
  product:
  - Splunk Phantom
type: response
version: 2
