Report on Hosts
This tool allows you to generate a report on the breakdown of a value present on the Hosts returned
by your query. For example, to generate a report on ports seen on Hosts with HTTP services, you could
query for services.service_name: HTTP and then generate a report on the breakdown
of the field
services.port
Report for Hosts
| services.service_name | services | |
|---|---|---|
| HTTP | 330,322,911 | 57.8% |
| UNKNOWN | 68,310,445 | 11.95% |
| SSH | 33,572,340 | 5.87% |
| CWMP | 18,507,226 | 3.24% |
| SNMP | 14,127,272 | 2.47% |
| IKE | 10,479,131 | 1.83% |
| SMTP | 10,247,063 | 1.79% |
| SOCKS | 8,531,155 | 1.49% |
| SIP | 7,159,217 | 1.25% |
| DNS | 6,603,508 | 1.16% |
| NTP | 5,643,153 | 0.99% |
| FTP | 5,552,868 | 0.97% |
| IMAP | 5,552,323 | 0.97% |
| POP3 | 3,912,902 | 0.68% |
| RDP | 3,722,591 | 0.65% |
| RTSP | 3,535,970 | 0.62% |
| L2TP | 3,316,847 | 0.58% |
| MYSQL | 3,160,699 | 0.55% |
| MIKROTIK_BW | 2,792,787 | 0.49% |
| PORTMAP | 2,434,373 | 0.43% |
| OPENVPN | 2,359,487 | 0.41% |
| MIKROTIK_WINBOX | 2,348,971 | 0.41% |
| PPTP | 1,875,394 | 0.33% |
| TELNET | 1,739,059 | 0.3% |
| VNC | 1,396,377 | 0.24% |
| KUBERNETES | 1,038,862 | 0.18% |
| DCERPC | 997,180 | 0.17% |
| SMB | 984,687 | 0.17% |
| HIKVISION | 972,280 | 0.17% |
| POSTGRES | 915,895 | 0.16% |
| MQTT | 826,233 | 0.14% |
| NETBIOS | 595,845 | 0.1% |
| MSSQL | 591,626 | 0.1% |
| WINRM | 516,051 | 0.09% |
| RSYNC | 501,295 | 0.09% |
| AMQP | 376,674 | 0.07% |
| DVR_IP | 323,456 | 0.06% |
| REDIS | 319,371 | 0.06% |
| MSMQ | 308,854 | 0.05% |
| CISCO_IPSLA | 300,891 | 0.05% |
| IPP | 288,159 | 0.05% |
| SBC_3CX | 283,491 | 0.05% |
| BGP | 256,216 | 0.04% |
| XMPP | 242,660 | 0.04% |
| HIKVISION_DNVRS | 223,179 | 0.04% |
| MINECRAFT | 211,951 | 0.04% |
| KRPC | 204,523 | 0.04% |
| COAP | 172,408 | 0.03% |
| MONGODB | 170,606 | 0.03% |
| WS_DISCOVERY | 157,542 | 0.03% |
| Remaining Results | 2,484,560 | 0.43% |
| Total | 571,468,564 | 100.0% |
JSON Report
{
"query": "",
"field": "services.service_name",
"total": 571468564,
"duration": 293,
"total_omitted": 2484560,
"potential_deviation": 19277,
"buckets": [
{
"key": "HTTP",
"count": 330322911
},
{
"key": "UNKNOWN",
"count": 68310445
},
{
"key": "SSH",
"count": 33572340
},
{
"key": "CWMP",
"count": 18507226
},
{
"key": "SNMP",
"count": 14127272
},
{
"key": "IKE",
"count": 10479131
},
{
"key": "SMTP",
"count": 10247063
},
{
"key": "SOCKS",
"count": 8531155
},
{
"key": "SIP",
"count": 7159217
},
{
"key": "DNS",
"count": 6603508
},
{
"key": "NTP",
"count": 5643153
},
{
"key": "FTP",
"count": 5552868
},
{
"key": "IMAP",
"count": 5552323
},
{
"key": "POP3",
"count": 3912902
},
{
"key": "RDP",
"count": 3722591
},
{
"key": "RTSP",
"count": 3535970
},
{
"key": "L2TP",
"count": 3316847
},
{
"key": "MYSQL",
"count": 3160699
},
{
"key": "MIKROTIK_BW",
"count": 2792787
},
{
"key": "PORTMAP",
"count": 2434373
},
{
"key": "OPENVPN",
"count": 2359487
},
{
"key": "MIKROTIK_WINBOX",
"count": 2348971
},
{
"key": "PPTP",
"count": 1875394
},
{
"key": "TELNET",
"count": 1739059
},
{
"key": "VNC",
"count": 1396377
},
{
"key": "KUBERNETES",
"count": 1038862
},
{
"key": "DCERPC",
"count": 997180
},
{
"key": "SMB",
"count": 984687
},
{
"key": "HIKVISION",
"count": 972280
},
{
"key": "POSTGRES",
"count": 915895
},
{
"key": "MQTT",
"count": 826233
},
{
"key": "NETBIOS",
"count": 595845
},
{
"key": "MSSQL",
"count": 591626
},
{
"key": "WINRM",
"count": 516051
},
{
"key": "RSYNC",
"count": 501295
},
{
"key": "AMQP",
"count": 376674
},
{
"key": "DVR_IP",
"count": 323456
},
{
"key": "REDIS",
"count": 319371
},
{
"key": "MSMQ",
"count": 308854
},
{
"key": "CISCO_IPSLA",
"count": 300891
},
{
"key": "IPP",
"count": 288159
},
{
"key": "SBC_3CX",
"count": 283491
},
{
"key": "BGP",
"count": 256216
},
{
"key": "XMPP",
"count": 242660
},
{
"key": "HIKVISION_DNVRS",
"count": 223179
},
{
"key": "MINECRAFT",
"count": 211951
},
{
"key": "KRPC",
"count": 204523
},
{
"key": "COAP",
"count": 172408
},
{
"key": "MONGODB",
"count": 170606
},
{
"key": "WS_DISCOVERY",
"count": 157542
}
]
}