Rare Remote Ports in Network Connections
The query analyzes IPv4 network connection events, counts occurrences per remote port, calculates their percentage of total connections, and lists only ports representing less than 10% of the traffic.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=NetworkConnectIP4
| groupBy([RemotePort], function=count(as=count), limit=max)
| [sum(count, as=total), sort(field=RemotePort, order=ascending, limit=20000)]
| percent := 100 * (count / total)
| drop([total])
| percent < 10Reference: GitHub CrowdStrike/logscale-community
Bottom_10_Percent_of_NetworkConnct_Port_Values.yml
CrowdStrike
Hunting
Endpoint, Network
Insight
2025-10-30
2025-10-30
