Security

Help with behavioral anomaly detection

responsys_cm
Builder

Our company provides a SaaS platform for our customers to manage marketing campaigns across a variety of channels. We are constantly targeted by hackers who either try and steal our customers' email lists or send spam out through their account.

We log all of the actions taken by users in their account. I'm not much of a quant guy, so I'd love to hear some feedback on how best to look for anomalous behavior. I could create a lookup table to save the average and standard deviation of actions by username. But I also see that there might be options using the transaction and anomalies commands.

Has anyone successfully implemented something like this before and what approach did you take?

Thx.

C

Tags (1)
0 Karma

richcollier
Path Finder

My company is developing a predictive analytics splunk app that does automatic anomaly detection. It will be on splunkbase in the next month or so and we're looking for beta customers. So far, early buzz is telling us that it's a killer app because it uses machine intelligence algorithms to automatically find anomalies.

Interested in joining our beta?

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...