Report on Hosts
This tool allows you to generate a report on the breakdown of a value present on the Hosts returned
by your query. For example, to generate a report on ports seen on Hosts with HTTP services, you could
query for services.service_name: HTTP and then generate a report on the breakdown
of the field
services.port
Report for Hosts
| services.service_name | services | |
|---|---|---|
| HTTP | 1,078,695,347 | 72.33% |
| UNKNOWN | 202,821,453 | 13.6% |
| SSH | 35,392,852 | 2.37% |
| CWMP | 21,361,106 | 1.43% |
| SNMP | 17,813,770 | 1.19% |
| SIP | 14,830,194 | 0.99% |
| FTP | 12,908,431 | 0.87% |
| SMTP | 12,901,055 | 0.87% |
| IKE | 11,516,769 | 0.77% |
| NTP | 6,606,140 | 0.44% |
| IMAP | 6,576,667 | 0.44% |
| POP3 | 6,141,315 | 0.41% |
| MYSQL | 5,986,460 | 0.4% |
| DNS | 4,962,161 | 0.33% |
| RTSP | 4,429,408 | 0.3% |
| L2TP | 4,134,864 | 0.28% |
| RDP | 3,682,840 | 0.25% |
| MIKROTIK_BW | 3,527,624 | 0.24% |
| PORTMAP | 3,353,453 | 0.22% |
| DCERPC | 3,338,209 | 0.22% |
| SOCKS | 2,933,384 | 0.2% |
| PPTP | 2,709,208 | 0.18% |
| OPENVPN | 2,613,235 | 0.18% |
| TELNET | 2,397,591 | 0.16% |
| KUBERNETES | 2,214,247 | 0.15% |
| WINRM | 1,711,449 | 0.11% |
| VNC | 1,499,863 | 0.1% |
| SMB | 1,442,932 | 0.1% |
| NETBIOS | 1,197,113 | 0.08% |
| HIKVISION | 930,295 | 0.06% |
| POSTGRES | 912,432 | 0.06% |
| MQTT | 787,067 | 0.05% |
| MSMQ | 619,949 | 0.04% |
| KRPC | 577,396 | 0.04% |
| REDIS | 447,439 | 0.03% |
| MSSQL | 434,602 | 0.03% |
| FORTIGUARD | 347,489 | 0.02% |
| DVR_IP | 341,892 | 0.02% |
| BGP | 334,062 | 0.02% |
| CISCO_IPSLA | 316,790 | 0.02% |
| PIGEONHOLE | 289,703 | 0.02% |
| IPP | 289,218 | 0.02% |
| RIPV1 | 277,778 | 0.02% |
| XMPP | 268,849 | 0.02% |
| COAP | 249,093 | 0.02% |
| AMQP | 233,328 | 0.02% |
| MINECRAFT | 208,580 | 0.01% |
| MDNS | 199,050 | 0.01% |
| CHECKPOINT_TOPOLOGY | 190,522 | 0.01% |
| MONGODB | 189,123 | 0.01% |
| WS_DISCOVERY | 175,398 | 0.01% |
| RSYNC | 150,826 | 0.01% |
| EIP | 127,135 | 0.01% |
| TFTP | 119,042 | 0.01% |
| LDAP | 115,717 | 0.01% |
| EPMD | 95,977 | 0.01% |
| SSDP | 91,896 | 0.01% |
| NATPMP | 89,812 | 0.01% |
| UPNP | 77,371 | 0.01% |
| VALVE | 74,279 | 0.0% |
| ELASTICSEARCH | 74,124 | 0.0% |
| LPD | 73,915 | 0.0% |
| MULTISTREAM_SELECT | 71,368 | 0.0% |
| AFP | 66,340 | 0.0% |
| PGBOUNCER | 65,921 | 0.0% |
| ORACLE | 63,697 | 0.0% |
| KERBEROS | 63,656 | 0.0% |
| SVR | 62,436 | 0.0% |
| DHCPDISCOVER | 60,528 | 0.0% |
| WDBRPC | 57,630 | 0.0% |
| MODBUS | 56,943 | 0.0% |
| PROMETHEUS | 54,808 | 0.0% |
| MURMUR | 49,363 | 0.0% |
| DIGI | 48,824 | 0.0% |
| EZVIZ | 44,215 | 0.0% |
| ZEROMQ | 43,050 | 0.0% |
| X11 | 39,135 | 0.0% |
| SLP | 36,767 | 0.0% |
| ANYCONNECT | 36,345 | 0.0% |
| APACHE_JSERV | 32,526 | 0.0% |
| TEAMSPEAK | 31,594 | 0.0% |
| UBIQUITI | 29,785 | 0.0% |
| CHARGEN | 28,368 | 0.0% |
| GTP | 28,359 | 0.0% |
| DAYTIME | 27,463 | 0.0% |
| IRC | 25,618 | 0.0% |
| BITTORRENT_TRACKER | 25,370 | 0.0% |
| ECHO | 25,057 | 0.0% |
| SCCM | 25,033 | 0.0% |
| POPPASSD | 24,656 | 0.0% |
| FOX | 22,989 | 0.0% |
| SPICE | 21,681 | 0.0% |
| SEVEN_DAYS_TO_DIE | 21,153 | 0.0% |
| IDENT | 20,323 | 0.0% |
| ARD | 20,001 | 0.0% |
| IPMI | 18,685 | 0.0% |
| ONVIF | 17,862 | 0.0% |
| KAFKA | 17,373 | 0.0% |
| DNP3 | 17,074 | 0.0% |
| BACNET | 16,266 | 0.0% |
| ETHEREUM | 16,258 | 0.0% |
| RDATE | 16,118 | 0.0% |
| NETIS | 15,716 | 0.0% |
| MEMCACHED | 15,439 | 0.0% |
| NMEA | 15,424 | 0.0% |
| NFS_MOUNTD | 14,864 | 0.0% |
| ISCSI | 14,622 | 0.0% |
| MONERO_P2P | 12,335 | 0.0% |
| IRC_BOUNCER | 11,854 | 0.0% |
| TIBIA | 11,705 | 0.0% |
| APPLE_AIRPORT_ADMIN | 10,700 | 0.0% |
| ATG | 10,463 | 0.0% |
| PJL | 10,201 | 0.0% |
| VENTRILO | 10,120 | 0.0% |
| FORTINET_FCM | 9,724 | 0.0% |
| SAP_ROUTER | 9,595 | 0.0% |
| NNTP | 9,379 | 0.0% |
| IEC60870_5_104 | 9,312 | 0.0% |
| FORTIGATE | 9,233 | 0.0% |
| S7 | 8,919 | 0.0% |
| ACTIVEMQ | 8,810 | 0.0% |
| RCON | 8,647 | 0.0% |
| ICAP | 8,019 | 0.0% |
| ZOOKEEPER | 7,876 | 0.0% |
| XDMCP | 7,862 | 0.0% |
| VOTIFIER | 7,037 | 0.0% |
| SKINNY | 6,990 | 0.0% |
| CITRIX | 6,912 | 0.0% |
| BITCOIN | 6,845 | 0.0% |
| ROCKETMQ | 6,834 | 0.0% |
| DB2 | 6,810 | 0.0% |
| CISCO_SMI | 6,802 | 0.0% |
| RADIUS | 6,444 | 0.0% |
| DICOM | 6,419 | 0.0% |
| RIFATRON | 6,050 | 0.0% |
| FINS | 5,303 | 0.0% |
| SENTINEL | 5,211 | 0.0% |
| NTRIP | 5,137 | 0.0% |
| TERRARIA | 4,607 | 0.0% |
| STATSD | 4,601 | 0.0% |
| BOLT | 4,495 | 0.0% |
| CASSANDRA | 4,413 | 0.0% |
| FREESWITCH | 4,356 | 0.0% |
| JAVA_RMI | 4,038 | 0.0% |
| OPC_UA | 3,999 | 0.0% |
| ETCD | 3,819 | 0.0% |
| CHROMECAST | 3,604 | 0.0% |
| ZABBIX | 3,150 | 0.0% |
| PC_ANYWHERE | 2,892 | 0.0% |
| CODESYS | 2,847 | 0.0% |
| CMORE | 2,684 | 0.0% |
| IMQBROKERD | 2,342 | 0.0% |
| WHOIS | 2,237 | 0.0% |
| CRESTRON_CP3 | 2,229 | 0.0% |
| BEANSTALKD | 2,156 | 0.0% |
| TEAM_VIEWER | 1,981 | 0.0% |
| CIMON_PLC | 1,847 | 0.0% |
| REALPORT | 1,632 | 0.0% |
| TUYA | 1,615 | 0.0% |
| STEAM_IHS | 1,446 | 0.0% |
| GEARMAN | 1,369 | 0.0% |
| RLOGIN | 1,275 | 0.0% |
| REDLION_CRIMSON | 1,267 | 0.0% |
| ADB | 1,167 | 0.0% |
| ELF_FILE | 1,151 | 0.0% |
| LSP | 1,104 | 0.0% |
| PCOM | 1,097 | 0.0% |
| PRO_CON_OS | 1,001 | 0.0% |
| TACACS_PLUS | 952 | 0.0% |
| SCPI | 936 | 0.0% |
| TPLINK_KASA | 931 | 0.0% |
| WEBLOGIC_T3 | 893 | 0.0% |
| RIPPLE | 828 | 0.0% |
| NBD | 799 | 0.0% |
| SNPP | 640 | 0.0% |
| SER2NET | 589 | 0.0% |
| PCWORX | 536 | 0.0% |
| FINGERD | 415 | 0.0% |
| RETHINKDB | 403 | 0.0% |
| GIT | 332 | 0.0% |
| QOTD | 301 | 0.0% |
| CMORE_HMI | 293 | 0.0% |
| COBALT_STRIKE | 288 | 0.0% |
| CISCO_FINGERD | 224 | 0.0% |
| CCSO_NAMESERVER | 207 | 0.0% |
| HID_VERTX | 155 | 0.0% |
| YAHOO_SMART_TV | 116 | 0.0% |
| HDDTEMP | 99 | 0.0% |
| MMS | 77 | 0.0% |
| RSH | 71 | 0.0% |
| GE_SRTP | 62 | 0.0% |
| IOTA | 45 | 0.0% |
| DICT | 32 | 0.0% |
| DARKCOMET | 19 | 0.0% |
| HART | 12 | 0.0% |
| GHOST | 11 | 0.0% |
| IBMNJE | 1 | 0.0% |
| TORCONTROL | 1 | 0.0% |
| Total | 1,491,280,229 | 100.0% |
JSON Report
{
"query": "*",
"field": "services.service_name",
"total": 1491280229,
"duration": 352,
"total_omitted": 0,
"potential_deviation": 0,
"buckets": [
{
"key": "HTTP",
"count": 1078695347
},
{
"key": "UNKNOWN",
"count": 202821453
},
{
"key": "SSH",
"count": 35392852
},
{
"key": "CWMP",
"count": 21361106
},
{
"key": "SNMP",
"count": 17813770
},
{
"key": "SIP",
"count": 14830194
},
{
"key": "FTP",
"count": 12908431
},
{
"key": "SMTP",
"count": 12901055
},
{
"key": "IKE",
"count": 11516769
},
{
"key": "NTP",
"count": 6606140
},
{
"key": "IMAP",
"count": 6576667
},
{
"key": "POP3",
"count": 6141315
},
{
"key": "MYSQL",
"count": 5986460
},
{
"key": "DNS",
"count": 4962161
},
{
"key": "RTSP",
"count": 4429408
},
{
"key": "L2TP",
"count": 4134864
},
{
"key": "RDP",
"count": 3682840
},
{
"key": "MIKROTIK_BW",
"count": 3527624
},
{
"key": "PORTMAP",
"count": 3353453
},
{
"key": "DCERPC",
"count": 3338209
},
{
"key": "SOCKS",
"count": 2933384
},
{
"key": "PPTP",
"count": 2709208
},
{
"key": "OPENVPN",
"count": 2613235
},
{
"key": "TELNET",
"count": 2397591
},
{
"key": "KUBERNETES",
"count": 2214247
},
{
"key": "WINRM",
"count": 1711449
},
{
"key": "VNC",
"count": 1499863
},
{
"key": "SMB",
"count": 1442932
},
{
"key": "NETBIOS",
"count": 1197113
},
{
"key": "HIKVISION",
"count": 930295
},
{
"key": "POSTGRES",
"count": 912432
},
{
"key": "MQTT",
"count": 787067
},
{
"key": "MSMQ",
"count": 619949
},
{
"key": "KRPC",
"count": 577396
},
{
"key": "REDIS",
"count": 447439
},
{
"key": "MSSQL",
"count": 434602
},
{
"key": "FORTIGUARD",
"count": 347489
},
{
"key": "DVR_IP",
"count": 341892
},
{
"key": "BGP",
"count": 334062
},
{
"key": "CISCO_IPSLA",
"count": 316790
},
{
"key": "PIGEONHOLE",
"count": 289703
},
{
"key": "IPP",
"count": 289218
},
{
"key": "RIPV1",
"count": 277778
},
{
"key": "XMPP",
"count": 268849
},
{
"key": "COAP",
"count": 249093
},
{
"key": "AMQP",
"count": 233328
},
{
"key": "MINECRAFT",
"count": 208580
},
{
"key": "MDNS",
"count": 199050
},
{
"key": "CHECKPOINT_TOPOLOGY",
"count": 190522
},
{
"key": "MONGODB",
"count": 189123
},
{
"key": "WS_DISCOVERY",
"count": 175398
},
{
"key": "RSYNC",
"count": 150826
},
{
"key": "EIP",
"count": 127135
},
{
"key": "TFTP",
"count": 119042
},
{
"key": "LDAP",
"count": 115717
},
{
"key": "EPMD",
"count": 95977
},
{
"key": "SSDP",
"count": 91896
},
{
"key": "NATPMP",
"count": 89812
},
{
"key": "UPNP",
"count": 77371
},
{
"key": "VALVE",
"count": 74279
},
{
"key": "ELASTICSEARCH",
"count": 74124
},
{
"key": "LPD",
"count": 73915
},
{
"key": "MULTISTREAM_SELECT",
"count": 71368
},
{
"key": "AFP",
"count": 66340
},
{
"key": "PGBOUNCER",
"count": 65921
},
{
"key": "ORACLE",
"count": 63697
},
{
"key": "KERBEROS",
"count": 63656
},
{
"key": "SVR",
"count": 62436
},
{
"key": "DHCPDISCOVER",
"count": 60528
},
{
"key": "WDBRPC",
"count": 57630
},
{
"key": "MODBUS",
"count": 56943
},
{
"key": "PROMETHEUS",
"count": 54808
},
{
"key": "MURMUR",
"count": 49363
},
{
"key": "DIGI",
"count": 48824
},
{
"key": "EZVIZ",
"count": 44215
},
{
"key": "ZEROMQ",
"count": 43050
},
{
"key": "X11",
"count": 39135
},
{
"key": "SLP",
"count": 36767
},
{
"key": "ANYCONNECT",
"count": 36345
},
{
"key": "APACHE_JSERV",
"count": 32526
},
{
"key": "TEAMSPEAK",
"count": 31594
},
{
"key": "UBIQUITI",
"count": 29785
},
{
"key": "CHARGEN",
"count": 28368
},
{
"key": "GTP",
"count": 28359
},
{
"key": "DAYTIME",
"count": 27463
},
{
"key": "IRC",
"count": 25618
},
{
"key": "BITTORRENT_TRACKER",
"count": 25370
},
{
"key": "ECHO",
"count": 25057
},
{
"key": "SCCM",
"count": 25033
},
{
"key": "POPPASSD",
"count": 24656
},
{
"key": "FOX",
"count": 22989
},
{
"key": "SPICE",
"count": 21681
},
{
"key": "SEVEN_DAYS_TO_DIE",
"count": 21153
},
{
"key": "IDENT",
"count": 20323
},
{
"key": "ARD",
"count": 20001
},
{
"key": "IPMI",
"count": 18685
},
{
"key": "ONVIF",
"count": 17862
},
{
"key": "KAFKA",
"count": 17373
},
{
"key": "DNP3",
"count": 17074
},
{
"key": "BACNET",
"count": 16266
},
{
"key": "ETHEREUM",
"count": 16258
},
{
"key": "RDATE",
"count": 16118
},
{
"key": "NETIS",
"count": 15716
},
{
"key": "MEMCACHED",
"count": 15439
},
{
"key": "NMEA",
"count": 15424
},
{
"key": "NFS_MOUNTD",
"count": 14864
},
{
"key": "ISCSI",
"count": 14622
},
{
"key": "MONERO_P2P",
"count": 12335
},
{
"key": "IRC_BOUNCER",
"count": 11854
},
{
"key": "TIBIA",
"count": 11705
},
{
"key": "APPLE_AIRPORT_ADMIN",
"count": 10700
},
{
"key": "ATG",
"count": 10463
},
{
"key": "PJL",
"count": 10201
},
{
"key": "VENTRILO",
"count": 10120
},
{
"key": "FORTINET_FCM",
"count": 9724
},
{
"key": "SAP_ROUTER",
"count": 9595
},
{
"key": "NNTP",
"count": 9379
},
{
"key": "IEC60870_5_104",
"count": 9312
},
{
"key": "FORTIGATE",
"count": 9233
},
{
"key": "S7",
"count": 8919
},
{
"key": "ACTIVEMQ",
"count": 8810
},
{
"key": "RCON",
"count": 8647
},
{
"key": "ICAP",
"count": 8019
},
{
"key": "ZOOKEEPER",
"count": 7876
},
{
"key": "XDMCP",
"count": 7862
},
{
"key": "VOTIFIER",
"count": 7037
},
{
"key": "SKINNY",
"count": 6990
},
{
"key": "CITRIX",
"count": 6912
},
{
"key": "BITCOIN",
"count": 6845
},
{
"key": "ROCKETMQ",
"count": 6834
},
{
"key": "DB2",
"count": 6810
},
{
"key": "CISCO_SMI",
"count": 6802
},
{
"key": "RADIUS",
"count": 6444
},
{
"key": "DICOM",
"count": 6419
},
{
"key": "RIFATRON",
"count": 6050
},
{
"key": "FINS",
"count": 5303
},
{
"key": "SENTINEL",
"count": 5211
},
{
"key": "NTRIP",
"count": 5137
},
{
"key": "TERRARIA",
"count": 4607
},
{
"key": "STATSD",
"count": 4601
},
{
"key": "BOLT",
"count": 4495
},
{
"key": "CASSANDRA",
"count": 4413
},
{
"key": "FREESWITCH",
"count": 4356
},
{
"key": "JAVA_RMI",
"count": 4038
},
{
"key": "OPC_UA",
"count": 3999
},
{
"key": "ETCD",
"count": 3819
},
{
"key": "CHROMECAST",
"count": 3604
},
{
"key": "ZABBIX",
"count": 3150
},
{
"key": "PC_ANYWHERE",
"count": 2892
},
{
"key": "CODESYS",
"count": 2847
},
{
"key": "CMORE",
"count": 2684
},
{
"key": "IMQBROKERD",
"count": 2342
},
{
"key": "WHOIS",
"count": 2237
},
{
"key": "CRESTRON_CP3",
"count": 2229
},
{
"key": "BEANSTALKD",
"count": 2156
},
{
"key": "TEAM_VIEWER",
"count": 1981
},
{
"key": "CIMON_PLC",
"count": 1847
},
{
"key": "REALPORT",
"count": 1632
},
{
"key": "TUYA",
"count": 1615
},
{
"key": "STEAM_IHS",
"count": 1446
},
{
"key": "GEARMAN",
"count": 1369
},
{
"key": "RLOGIN",
"count": 1275
},
{
"key": "REDLION_CRIMSON",
"count": 1267
},
{
"key": "ADB",
"count": 1167
},
{
"key": "ELF_FILE",
"count": 1151
},
{
"key": "LSP",
"count": 1104
},
{
"key": "PCOM",
"count": 1097
},
{
"key": "PRO_CON_OS",
"count": 1001
},
{
"key": "TACACS_PLUS",
"count": 952
},
{
"key": "SCPI",
"count": 936
},
{
"key": "TPLINK_KASA",
"count": 931
},
{
"key": "WEBLOGIC_T3",
"count": 893
},
{
"key": "RIPPLE",
"count": 828
},
{
"key": "NBD",
"count": 799
},
{
"key": "SNPP",
"count": 640
},
{
"key": "SER2NET",
"count": 589
},
{
"key": "PCWORX",
"count": 536
},
{
"key": "FINGERD",
"count": 415
},
{
"key": "RETHINKDB",
"count": 403
},
{
"key": "GIT",
"count": 332
},
{
"key": "QOTD",
"count": 301
},
{
"key": "CMORE_HMI",
"count": 293
},
{
"key": "COBALT_STRIKE",
"count": 288
},
{
"key": "CISCO_FINGERD",
"count": 224
},
{
"key": "CCSO_NAMESERVER",
"count": 207
},
{
"key": "HID_VERTX",
"count": 155
},
{
"key": "YAHOO_SMART_TV",
"count": 116
},
{
"key": "HDDTEMP",
"count": 99
},
{
"key": "MMS",
"count": 77
},
{
"key": "RSH",
"count": 71
},
{
"key": "GE_SRTP",
"count": 62
},
{
"key": "IOTA",
"count": 45
},
{
"key": "DICT",
"count": 32
},
{
"key": "DARKCOMET",
"count": 19
},
{
"key": "HART",
"count": 12
},
{
"key": "GHOST",
"count": 11
},
{
"key": "IBMNJE",
"count": 1
},
{
"key": "TORCONTROL",
"count": 1
}
]
}