Splunk Search

Using Standard Deviation to track SSH traffic

serwin
Explorer

I'm looking for a way to traffic the average ssh traffic between two IP addresses (source IP and destination IP) and hopefully find when a host is doing more SSH traffic than usual and alert on it. I've been looking through some of the standard deviation paperwork and I think I found a search I wanted to do but the standard deviation I get is zero; which doesn't make sense.

Here is what I've been playing around with.

sourcetype="cisco:asa" dest_port=22
| stats count by src_ip, dest_ip 
| stats mean(count) as mean, stdev(count) AS stdev by src_ip 
| eval stdv_percentage=(mean/stdev)*100
0 Karma

cmerriman
Super Champion

have you looked through this? http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Findingandremovingoutliers
you might want to use IQR, instead of standard dev, but it depends on the data and what works best.

try something like this:

sourcetype="cisco:asa" dest_port=22 
| stats count by src_ip, dest_ip 
| eventstats avg(count) as avg stdev(count) as stdev by src_ip
| eval lower_bound=avg-(stdev*2)
| eval upper_bound=avg+(stdev*2)
| eval isOutlier=if(count>upper_bound OR count<lower_bound,10,0)
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...