Alerting

Detect Anomaly in User Login Logs

binitshrestha
Explorer

Hello Splunk team and community,

I am working with the Splunk Machine Learning (ML) toolkit to detect anomalies in product logs. Particularly, I have logs in Splunk that contain usernames and cities the user has logged in from. Is there any way I can use ML, or any other methods in Splunk, to detect anomalous login locations for a particular user by analyzing the history of that user's logins?

The logs I have contain hundreds of different users, so this alert would need to map each user with their login locations and detect any anomalous cities from their history of locations. If anyone has any ideas, tips, or guidance, I will be very grateful!

Thanks!
Binit

0 Karma

hagjos43
Contributor

Not sure if this will do the trick for you or not, but there are two queries posted on GoSplunk that might help! It's not going to get exactly what you want, but may point you in the right direction.

  1. https://gosplunk.com/detect-username-guessing-brute-force-attacks/
  2. https://gosplunk.com/compare-successful-internal-vs-external-connections/
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...