topic Can anyone please help to create a DOS/DDOS alert without using any application in Splunk? in Alerting

Can anyone please help to create a DOS/DDOS alert without using any application in Splunk?

mlm — Fri, 03 Feb 2023 16:17:16 GMT

Hello guys,

Can anyone please help me to create a DOS/DDOS alert without using any application in splunk.

For example:

if source IPs sending thousands of TCP packets simultaneously within the 15-20 minutes or so.

I can't seem to find any docs that related to this.

TIA

Re: Can anyone please help to create a DOS/DDOS alert without using any application in Splunk?

marioespbaires — Tue, 31 Oct 2023 21:41:17 GMT

Hello there,

did you find how to do it? if so, may you share it? 😄

Re: Can anyone please help to create a DOS/DDOS alert without using any application in Splunk?

isoutamo — Thu, 02 Nov 2023 12:09:59 GMT

Hi
To getting help you must 1st tell what you have on your splunk. Describe your log events, indexes etc.
This is doable if/when you have suitable data in splunk.
r. Ismo