Archive

Detect Anomaly in User Login Logs

Explorer

Hello Splunk team and community,

I am working with the Splunk Machine Learning (ML) toolkit to detect anomalies in product logs. Particularly, I have logs in Splunk that contain usernames and cities the user has logged in from. Is there any way I can use ML, or any other methods in Splunk, to detect anomalous login locations for a particular user by analyzing the history of that user's logins?

The logs I have contain hundreds of different users, so this alert would need to map each user with their login locations and detect any anomalous cities from their history of locations. If anyone has any ideas, tips, or guidance, I will be very grateful!

Thanks!
Binit

0 Karma

Contributor

Not sure if this will do the trick for you or not, but there are two queries posted on GoSplunk that might help! It's not going to get exactly what you want, but may point you in the right direction.

  1. https://gosplunk.com/detect-username-guessing-brute-force-attacks/
  2. https://gosplunk.com/compare-successful-internal-vs-external-connections/
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!