How to write a search to alert on anomalous network traffic?

[andre_tucker]

I would like to be able to take a general baseline of packet count by source IP address (internal) and source port during a particular point in time and alert when a single IP has a single source port whose count is greater than several standard deviations outside the norm. What would be the most efficient way of doing this? I should also note that I will only be looking at ports between 49,000 and 65535.

[tjr1775 · Accepted solution]

The easiest and most efficient way to do this is with the Machine Learning Toolkit app. you would select "Detect Numeric Outliers" and then you would write your base search simply as:

sourcetype=xxx (src_port > 49000 AND src_port < 65535), and then select the fields you would like to conduct outlier detection on.

See the screenshot below. You can write normal Splunk alerts from there on the results. That would definitely be the easiest and most efficient. It has all your needed functionality built-in.

[tjr1775]

Couple questions- 1) how many unique internal (source) IPs do you have, 2) how long do you want to go back for your historical baseline (30 days? 60 days? 90?), 3) are you dead set on 2x stdev as an outlier detector?, and lastly, 4) do you have the capability to download/install/use the Splunk Machine Learning Toolkit?