topic Re: What command is used for trying to identify anomaly logons from common users? in Splunk Search

What command is used for trying to identify anomaly logons from common users?

keldridg2 — Fri, 16 Aug 2019 13:30:25 GMT

Is there a website on Splunk docs that describe interesting fields and what each field is about?

What command can I use for Splunk with trying to identify anomaly logons from common users and to be able to point out a spike in logons from one user?

Re: What command is used for trying to identify anomaly logons from common users?

solarboyz1 — Fri, 16 Aug 2019 14:50:46 GMT

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

Re: What command is used for trying to identify anomaly logons from common users?

keldridg2 — Fri, 16 Aug 2019 14:57:25 GMT

Thank you for helping me on my issue.

Re: What command is used for trying to identify anomaly logons from common users?

aokur_splunk — Fri, 17 Jan 2020 02:49:31 GMT

one idea for detecting a spike or outlier in logons would be to summarize, by user, how often they login.. say # of times a week or day.. you could try for hour but you'll likely get a lot of noise..

start with something like

'index=<security> sourcetype=<logins> |bin span=1d _time | stats count by <user> _time'

Then summary index this data over a recurring period to be able to detect outliers. - try the |collect command

Now apply the standard deviation method of detecting outliers - essentially check if the sample is some standard devs from the mean.
The MLTK toolkit has some fun features for this, some math behind it is:

mean logins by user
calculate standard deviation
test for : (logins < (mean + 2 standard deviations) )
if true - this is technically an outlier. you can adjust your standard deviation to experiment

Then schedule this search to run over a time period and create an alert if there are results.. or to send you a report

I would check out the MLTK though, lots of great stuff in there.. Security Essentials has a user case for this as well