Report on Hosts
This tool allows you to generate a report on the breakdown of a value present on the Hosts returned
by your query. For example, to generate a report on ports seen on Hosts with HTTP services, you could
query for services.service_name: HTTP and then generate a report on the breakdown
of the field
services.port
Report for Hosts
| services.service_name | services | |
|---|---|---|
| HTTP | 344,679,277 | 59.12% |
| UNKNOWN | 56,882,936 | 9.76% |
| SSH | 32,746,989 | 5.62% |
| CWMP | 18,038,193 | 3.09% |
| SNMP | 13,850,746 | 2.38% |
| SMTP | 12,460,171 | 2.14% |
| SOCKS | 11,845,642 | 2.03% |
| IKE | 10,095,709 | 1.73% |
| SIP | 7,498,405 | 1.29% |
| DNS | 6,297,744 | 1.08% |
| IMAP | 6,248,555 | 1.07% |
| FTP | 5,776,078 | 0.99% |
| NTP | 5,501,777 | 0.94% |
| POP3 | 4,260,830 | 0.73% |
| RTSP | 3,641,337 | 0.62% |
| RDP | 3,361,444 | 0.58% |
| L2TP | 3,174,852 | 0.54% |
| MDNS | 3,155,831 | 0.54% |
| MYSQL | 3,102,801 | 0.53% |
| MIKROTIK_BW | 2,724,081 | 0.47% |
| PORTMAP | 2,505,843 | 0.43% |
| OPENVPN | 2,354,975 | 0.4% |
| MIKROTIK_WINBOX | 2,282,476 | 0.39% |
| PPTP | 1,816,132 | 0.31% |
| TELNET | 1,668,509 | 0.29% |
| VNC | 1,303,425 | 0.22% |
| HIKVISION | 1,293,052 | 0.22% |
| KUBERNETES | 1,160,097 | 0.2% |
| RSYNC | 1,022,782 | 0.18% |
| POSTGRES | 940,968 | 0.16% |
| SMB | 913,207 | 0.16% |
| DCERPC | 910,631 | 0.16% |
| MQTT | 800,793 | 0.14% |
| NETBIOS | 737,171 | 0.13% |
| MSSQL | 598,585 | 0.1% |
| AMQP | 589,849 | 0.1% |
| WINRM | 540,018 | 0.09% |
| DVR_IP | 359,019 | 0.06% |
| IRC | 344,442 | 0.06% |
| MSMQ | 340,894 | 0.06% |
| REDIS | 316,589 | 0.05% |
| CISCO_IPSLA | 294,485 | 0.05% |
| IPP | 283,414 | 0.05% |
| PIGEONHOLE | 282,326 | 0.05% |
| SBC_3CX | 281,708 | 0.05% |
| BGP | 268,550 | 0.05% |
| XMPP | 228,256 | 0.04% |
| MINECRAFT | 210,042 | 0.04% |
| COAP | 179,897 | 0.03% |
| KRPC | 169,777 | 0.03% |
| Remaining Results | 2,631,958 | 0.45% |
| Total | 582,973,268 | 100.0% |
JSON Report
{
"query": "",
"field": "services.service_name",
"total": 582973268,
"duration": 270,
"total_omitted": 2631958,
"potential_deviation": 19307,
"buckets": [
{
"key": "HTTP",
"count": 344679277
},
{
"key": "UNKNOWN",
"count": 56882936
},
{
"key": "SSH",
"count": 32746989
},
{
"key": "CWMP",
"count": 18038193
},
{
"key": "SNMP",
"count": 13850746
},
{
"key": "SMTP",
"count": 12460171
},
{
"key": "SOCKS",
"count": 11845642
},
{
"key": "IKE",
"count": 10095709
},
{
"key": "SIP",
"count": 7498405
},
{
"key": "DNS",
"count": 6297744
},
{
"key": "IMAP",
"count": 6248555
},
{
"key": "FTP",
"count": 5776078
},
{
"key": "NTP",
"count": 5501777
},
{
"key": "POP3",
"count": 4260830
},
{
"key": "RTSP",
"count": 3641337
},
{
"key": "RDP",
"count": 3361444
},
{
"key": "L2TP",
"count": 3174852
},
{
"key": "MDNS",
"count": 3155831
},
{
"key": "MYSQL",
"count": 3102801
},
{
"key": "MIKROTIK_BW",
"count": 2724081
},
{
"key": "PORTMAP",
"count": 2505843
},
{
"key": "OPENVPN",
"count": 2354975
},
{
"key": "MIKROTIK_WINBOX",
"count": 2282476
},
{
"key": "PPTP",
"count": 1816132
},
{
"key": "TELNET",
"count": 1668509
},
{
"key": "VNC",
"count": 1303425
},
{
"key": "HIKVISION",
"count": 1293052
},
{
"key": "KUBERNETES",
"count": 1160097
},
{
"key": "RSYNC",
"count": 1022782
},
{
"key": "POSTGRES",
"count": 940968
},
{
"key": "SMB",
"count": 913207
},
{
"key": "DCERPC",
"count": 910631
},
{
"key": "MQTT",
"count": 800793
},
{
"key": "NETBIOS",
"count": 737171
},
{
"key": "MSSQL",
"count": 598585
},
{
"key": "AMQP",
"count": 589849
},
{
"key": "WINRM",
"count": 540018
},
{
"key": "DVR_IP",
"count": 359019
},
{
"key": "IRC",
"count": 344442
},
{
"key": "MSMQ",
"count": 340894
},
{
"key": "REDIS",
"count": 316589
},
{
"key": "CISCO_IPSLA",
"count": 294485
},
{
"key": "IPP",
"count": 283414
},
{
"key": "PIGEONHOLE",
"count": 282326
},
{
"key": "SBC_3CX",
"count": 281708
},
{
"key": "BGP",
"count": 268550
},
{
"key": "XMPP",
"count": 228256
},
{
"key": "MINECRAFT",
"count": 210042
},
{
"key": "COAP",
"count": 179897
},
{
"key": "KRPC",
"count": 169777
}
]
}