Rare Remote Ports in Network Connections
The query analyzes IPv4 network connection events, counts occurrences per remote port, calculates their percentage of total connections, and lists only ports representing less than 10% of the traffic.
CQL · Falcon Next-Gen SIEMCopy query
Loading query…Bottom_10_Percent_of_NetworkConnct_Port_Values.yml
CrowdStrike
Hunting
Endpoint, Network
Insight
