mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
LaLaGuy
e2443809bb
### **Describe the bug** When interesting_ports_lookup is used, only the port is checked, not the protocol. Plus, only the first result is returned. This lookup include several entries for the same port (like 514 rsh/syslog) and the wrong entry can get returned. This create false match. The wrong enrichment is given (including a wrong transport method) and a notable is generated when it shouldn't. It can also be greatly optimized by moving the filter logic to the where of the tstats. ### **Expected behavior** If a 514 udp is detected by the firewall, it should match syslog and not create a notable (or risk) telling me we detected a rsh 514 tcp. ### **Additional context** Here is a solution (we get the transport from the log instead of adding it from the lookup, add transport to the match and move the filter logique up).