Splunk Enterprise Security

Find anomalous network traffic of a user

narisree1
Loves-to-Learn Everything

Hi team,

I m trying to find network traffic of a user and classify it as high or normal based on avg and stdev calculations

QUERY :
index="pan_logs" sourcetype="pan:traffic" user!=unknown | stats sum(bytes) as bytes by _time,user |eval MB = round(bytes/1024/1024,4)|bin span=1d _time | stats avg(MB) as avg stdev(MB) as stdv by user,_time|eval avg = round(avg,4) , stdv = round(stdv,4) | eval Volume_Type= if((avg+2*stdv)> MB , "HIGH" , "NORMAL

However the avg and stdev calculation is wrong here as it collects per day basis and not when i keep it for last 7 days.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Splunk has built in functionality to make this much easier. Try using "anomalies" and/or "anomalousvalue"

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Anomalies

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Anomalousvalue

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

narisree1
Loves-to-Learn Everything

Thanks for the response.However i am not sure of the threshold value to be set as it can change user to user hence i calculated it based on avg and stdev .i understand we can use streamstats command but i am unable to calculate avg for last 7 days as i had already bin for 1 day at start.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...