Help with behavioral anomaly detection


Our company provides a SaaS platform for our customers to manage marketing campaigns across a variety of channels. We are constantly targeted by hackers who either try and steal our customers' email lists or send spam out through their account.

We log all of the actions taken by users in their account. I'm not much of a quant guy, so I'd love to hear some feedback on how best to look for anomalous behavior. I could create a lookup table to save the average and standard deviation of actions by username. But I also see that there might be options using the transaction and anomalies commands.

Has anyone successfully implemented something like this before and what approach did you take?



Tags (1)
0 Karma

Path Finder

My company is developing a predictive analytics splunk app that does automatic anomaly detection. It will be on splunkbase in the next month or so and we're looking for beta customers. So far, early buzz is telling us that it's a killer app because it uses machine intelligence algorithms to automatically find anomalies.

Interested in joining our beta?

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...