SPLK-5001 · Question #83
An analyst has been asked to report on VPC Flow traffic to their EC2 instances in AWS and wants to only examine blocked connections for source and destination IP address pairs. In order to filter…
The correct answer is A. index=aws sourcetype=aws:cloudwatchlogs:vpcflow action=blocked | fields src_ip, dest_ip | stats count values(dest_ip) as listDestinations by src_ip | eval numDestinations=len(listDestinations) | where numDestinations > 5 AND count > 1000 | table src_ip, listDestinations. The first search meets all the requirements - it filters to blocked traffic, aggregates per source IP, computes the number of distinct destinations, applies the “>5 destinations AND >1000 blocks” criteria, and then uses table src_ip, listDestinations to display only the source…
Question
An analyst has been asked to report on VPC Flow traffic to their EC2 instances in AWS and wants to only examine blocked connections for source and destination IP address pairs. In order to filter down to just the pertinent data, the analyst is only looking for source IP addresses which are attempting to connect to over five destination IP addresses and which have over a thousand blocked connections. Additionally, leadership would like to only see the applicable source IP addresses and a list of the destination IP addresses in the report and nothing else. Which of the following Splunk searches meets these requirements? A. B. C. D.
Exhibits
Options
- Aindex=aws sourcetype=aws:cloudwatchlogs:vpcflow action=blocked | fields src_ip, dest_ip | stats count values(dest_ip) as listDestinations by src_ip | eval numDestinations=len(listDestinations) | where numDestinations > 5 AND count > 1000 | table src_ip, listDestinations
- Bindex=aws sourcetype=aws:cloudwatchlogs:vpcflow action=blocked | fields src_ip, dest_ip | stats count dc(dest_ip) as numDestinations values(dest_ip) as listDestinations by src_ip | where numDestinations > 5 AND count > 1000 | fields - count numDestinations
- Cindex=aws sourcetype=aws:cloudwatchlogs:vpcflow action=blocked | fields src_ip, dest_ip | stats count values(dest_ip) as listDestinations by src_ip | eval numDestinations=len(listDestinations) | where numDestinations > 5 AND count > 1000 | fields - count numDestinations
- Dindex=aws sourcetype=aws:cloudwatchlogs:vpcflow action=blocked | fields src_ip, dest_ip | stats count(dest_ip) as numDestinations values(dest_ip) as listDestinations by src_ip | where numDestinations > 5 AND count > 1000 | fields src_ip, listDestinations
How the community answered
(31 responses)- A48% (15)
- B26% (8)
- C16% (5)
- D10% (3)
Explanation
The first search meets all the requirements - it filters to blocked traffic, aggregates per source IP, computes the number of distinct destinations, applies the “>5 destinations AND >1000 blocks” criteria, and then uses table src_ip, listDestinations to display only the source IPs and their destination lists.
Topics
Community Discussion
No community discussion yet for this question.