Help with behavioral anomaly detection


Our company provides a SaaS platform for our customers to manage marketing campaigns across a variety of channels. We are constantly targeted by hackers who either try and steal our customers' email lists or send spam out through their account.

We log all of the actions taken by users in their account. I'm not much of a quant guy, so I'd love to hear some feedback on how best to look for anomalous behavior. I could create a lookup table to save the average and standard deviation of actions by username. But I also see that there might be options using the transaction and anomalies commands.

Has anyone successfully implemented something like this before and what approach did you take?



Tags (1)
0 Karma

Path Finder

My company is developing a predictive analytics splunk app that does automatic anomaly detection. It will be on splunkbase in the next month or so and we're looking for beta customers. So far, early buzz is telling us that it's a killer app because it uses machine intelligence algorithms to automatically find anomalies.

Interested in joining our beta?

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...