Feedback:

openports

Use the openports operator to enrich results related to an IP address or field containing an IP address using the ThreatStream OpenPorts enrichment.

Syntax

|openports <field or value>

<field or value>

Specify the field name or IP address to look up.

Usage

You can use the openports operator to enrich results that inform your security orchestration, automation and response actions. For each IP address passed to the enrichment, a list of open ports reported within the previous seven days is returned.

Examples

Example 1: Enrich source IP address field with open ports data.

Copy 
|openports src_ip

Example 2: Enrich a specific IP address with open ports data.

Copy 
|openports "192.0.2.1"