Behavior/Anomaly based correlation search/alert

[pavanbmishra]

Hello SMEs...good day,

Here i would like to create one behavior based or can say anomaly based alert where we have fields name IP_ address and total_bytes (sum of bytes sent + byte_received).

Now the condition is if 'total_bytes' consumed by 'IP_Address' in the current week is more than 50% or less than 50% what has been consumed over previous week, we need one alert to be triggered. Any idea or query which can meet the requirement would be really helpful....Many thanks in advance

[ITWhisperer]

Start with a query that covers the last two weeks, then sum the byte by IP address, using a bin size of 1 week. This should give you the data you require. Then evaluate the values for the two weeks to determine whether the condition has been met. Use this query as the basis for your alert.