Splunk Enterprise Security

Find anomalous network traffic of a user

narisree1
Loves-to-Learn Everything

Hi team,

I m trying to find network traffic of a user and classify it as high or normal based on avg and stdev calculations

QUERY :
index="pan_logs" sourcetype="pan:traffic" user!=unknown | stats sum(bytes) as bytes by _time,user |eval MB = round(bytes/1024/1024,4)|bin span=1d _time | stats avg(MB) as avg stdev(MB) as stdv by user,_time|eval avg = round(avg,4) , stdv = round(stdv,4) | eval Volume_Type= if((avg+2*stdv)> MB , "HIGH" , "NORMAL

However the avg and stdev calculation is wrong here as it collects per day basis and not when i keep it for last 7 days.

0 Karma

codebuilder
Influencer

Splunk has built in functionality to make this much easier. Try using "anomalies" and/or "anomalousvalue"

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Anomalies

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Anomalousvalue

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

narisree1
Loves-to-Learn Everything

Thanks for the response.However i am not sure of the threshold value to be set as it can change user to user hence i calculated it based on avg and stdev .i understand we can use streamstats command but i am unable to calculate avg for last 7 days as i had already bin for 1 day at start.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...