topic Re: Use case SMB Traffic by bytes transfer in Getting Data In

Use case SMB Traffic by bytes transfer

splunkcol — Mon, 14 Sep 2020 20:22:48 GMT

Hello, I need to create a use case that monitors the bytes transferred from one host to another, either by SMB or by another method, be it from the LAN or the WAN.

The log does not have any fields that refer to the size of the transferred data. How can I monitor these transfers from one host to another?

I have this base to adjust it to what I need or accept suggestions (font)

Thank you

index=* ((tag=network tag=communicate) OR (sourcetype=pan*traffic OR sourcetype=opsec OR sourcetype=cisco:asa OR sourcetype=stream* )) action=allowed (app=smb OR dest_port=139 OR dest_port=445)  | bucket _time span=1d | stats count by _time src_ip dest_ip dest_port

Re: Use case SMB Traffic by bytes transfer

richgalloway — Mon, 14 Sep 2020 20:52:56 GMT

If the data does not include a byte count or some other size indication then Splunk cannot use size as a monitoring criteria.

Re: Use case SMB Traffic by bytes transfer

isoutamo — Mon, 14 Sep 2020 21:00:53 GMT

Just like @richgalloway said, you cannot calculate exact traffic without size information on logs. Of course you could calculate estimate of maximum traffic based on event count * max size of event, but probably this is not what you are looking for?
R. Ismo

Re: Use case SMB Traffic by bytes transfer

splunkcol — Mon, 14 Sep 2020 21:12:02 GMT

@isoutamo The method you suggest, I don't mind if you don't tell me how many bytes or Gygabytes were transferred, but it would help me if you alert me if there is abnormal traffic from one host to another.

I need to prevent possible information leakage

When you talk about event count, do you mean the number of events from one host to another?

If so, I would appreciate how the query would be.

thank you