Detect Scanning IP Blocks in Splunk

| union
[
search index=network (sourcetype="cisco:asa" OR sourcetype="pan:traffic" OR sourcetype="pan:threat" OR sourcetype="juniper:junos:firewall" OR sourcetype="fortigate_traffic" OR sourcetype="checkpoint:firewall" OR sourcetype="syslog")
| eval src_ip=coalesce(src_ip, src, SourceIP, source_ip)
| eval dest_ip=coalesce(dest_ip, dst, DestinationIP, destination_ip)
| eval dest_port=coalesce(dest_port, dpt, DestinationPort, destination_port)
| where isnotnull(src_ip) AND isnotnull(dest_ip)
| where NOT match(src_ip, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)")
| bucket _time span=5m
| stats
    dc(dest_port) as unique_dest_ports,
    dc(dest_ip) as unique_dest_hosts,
    count as total_connections,
    values(dest_port) as dest_ports_list,
    values(dest_ip) as dest_hosts_list,
    earliest(_time) as first_seen,
    latest(_time) as last_seen
  by src_ip, _time, sourcetype
| where unique_dest_ports >= 20 OR unique_dest_hosts >= 15
| eval scan_type=case(
    unique_dest_hosts >= 15 AND unique_dest_ports <= 5, "IP Block Sweep",
    unique_dest_ports >= 20 AND unique_dest_hosts <= 3, "Port Scan",
    unique_dest_hosts >= 15 AND unique_dest_ports >= 20, "Full Network Scan",
    1==1, "Unknown Scan Pattern"
  )
| eval scan_duration_seconds=last_seen - first_seen
| eval detection_branch="perimeter_firewall"
| table _time, src_ip, scan_type, unique_dest_ports, unique_dest_hosts, total_connections, scan_duration_seconds, dest_ports_list, detection_branch, sourcetype
| sort - unique_dest_hosts
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\nmap.exe" OR Image="*\\masscan.exe" OR Image="*\\hping3.exe" OR Image="*\\fping.exe"
   OR CommandLine="*nmap *" OR CommandLine="*masscan *" OR CommandLine="* -sS *" OR CommandLine="* -sT *"
   OR CommandLine="* -sV *" OR CommandLine="* -sn *" OR CommandLine="* -Pn *" OR CommandLine="*--scan-delay*"
   OR CommandLine="*port-scan*" OR CommandLine="*portscan*")
| eval src_ip=host
| eval scan_type="Scan Tool Executed on Endpoint"
| eval unique_dest_ports=null()
| eval unique_dest_hosts=null()
| eval total_connections=null()
| eval scan_duration_seconds=null()
| eval dest_ports_list=null()
| eval detection_branch="endpoint"
| table _time, src_ip, scan_type, User, CommandLine, Image, unique_dest_ports, unique_dest_hosts, total_connections, detection_branch
| sort - _time
]