Splunk Enterprise Security

What is the best method of calculating variance, Extreme Search or just Stats?

joeldavideng
Path Finder

I currently have several behavioral anomaly searches that report users exhibiting authentication behavior that is X number of standard deviations above their mean or just in the 9Xth percentile based on a baseline period of behavior. After reading George Starcher's blog entries on the subject of Extreme Search I am considering implementing those searches using that app, but I am concerned that I am losing precision because I can't say for certain that "anomalous" means three standard deviations above the mean. I would like to hear about other users' experiences doing the same and whether you think the migration is worth the effort.

0 Karma
1 Solution

starcher
Influencer

Extreme search is "fuzzy". If you want precise traditional stats just do that.

View solution in original post

0 Karma

starcher
Influencer

Extreme search is "fuzzy". If you want precise traditional stats just do that.

0 Karma

joeldavideng
Path Finder

Straight from the horse's mouth. Thanks Starcher.

0 Karma
Get Updates on the Splunk Community!

Join the Splunk Developer Program Hackathon: Splunk Build-a-thon!

The Splunk Developer Program is launching in beta, and we’re celebrating with an exciting hackathon! This is ...

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...