Splunk Enterprise Security

What is the best method of calculating variance, Extreme Search or just Stats?

joeldavideng
Path Finder

I currently have several behavioral anomaly searches that report users exhibiting authentication behavior that is X number of standard deviations above their mean or just in the 9Xth percentile based on a baseline period of behavior. After reading George Starcher's blog entries on the subject of Extreme Search I am considering implementing those searches using that app, but I am concerned that I am losing precision because I can't say for certain that "anomalous" means three standard deviations above the mean. I would like to hear about other users' experiences doing the same and whether you think the migration is worth the effort.

0 Karma
1 Solution

starcher
Influencer

Extreme search is "fuzzy". If you want precise traditional stats just do that.

View solution in original post

0 Karma

starcher
Influencer

Extreme search is "fuzzy". If you want precise traditional stats just do that.

0 Karma

joeldavideng
Path Finder

Straight from the horse's mouth. Thanks Starcher.

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...