Help with behavioral anomaly detection

[responsys_cm]

Our company provides a SaaS platform for our customers to manage marketing campaigns across a variety of channels. We are constantly targeted by hackers who either try and steal our customers' email lists or send spam out through their account.

We log all of the actions taken by users in their account. I'm not much of a quant guy, so I'd love to hear some feedback on how best to look for anomalous behavior. I could create a lookup table to save the average and standard deviation of actions by username. But I also see that there might be options using the transaction and anomalies commands.

Has anyone successfully implemented something like this before and what approach did you take?

Thx.

C

[richcollier]

My company is developing a predictive analytics splunk app that does automatic anomaly detection. It will be on splunkbase in the next month or so and we're looking for beta customers. So far, early buzz is telling us that it's a killer app because it uses machine intelligence algorithms to automatically find anomalies.

Interested in joining our beta?