Detect Anomaly in User Login Logs

[binitshrestha]

Hello Splunk team and community,

I am working with the Splunk Machine Learning (ML) toolkit to detect anomalies in product logs. Particularly, I have logs in Splunk that contain usernames and cities the user has logged in from. Is there any way I can use ML, or any other methods in Splunk, to detect anomalous login locations for a particular user by analyzing the history of that user's logins?

The logs I have contain hundreds of different users, so this alert would need to map each user with their login locations and detect any anomalous cities from their history of locations. If anyone has any ideas, tips, or guidance, I will be very grateful!

Thanks!
Binit

[hagjos43]

Not sure if this will do the trick for you or not, but there are two queries posted on GoSplunk that might help! It's not going to get exactly what you want, but may point you in the right direction.

1. https://gosplunk.com/detect-username-guessing-brute-force-attacks/
2. https://gosplunk.com/compare-successful-internal-vs-external-connections/