Splunk Search

What command is used for trying to identify anomaly logons from common users?

New Member

Is there a website on Splunk docs that describe interesting fields and what each field is about?

What command can I use for Splunk with trying to identify anomaly logons from common users and to be able to point out a spike in logons from one user?

0 Karma
1 Solution

Builder

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

one idea for detecting a spike or outlier in logons would be to summarize, by user, how often they login.. say # of times a week or day.. you could try for hour but you'll likely get a lot of noise..

start with something like

'index=<security> sourcetype=<logins> |bin span=1d _time | stats count by <user> _time'

Then summary index this data over a recurring period to be able to detect outliers. - try the |collect command

Now apply the standard deviation method of detecting outliers - essentially check if the sample is some standard devs from the mean.
The MLTK toolkit has some fun features for this, some math behind it is:

  1. mean logins by user
  2. calculate standard deviation
  3. test for : (logins < (mean + 2 standard deviations) )
  4. if true - this is technically an outlier. you can adjust your standard deviation to experiment

Then schedule this search to run over a time period and create an alert if there are results.. or to send you a report

I would check out the MLTK though, lots of great stuff in there.. Security Essentials has a user case for this as well

0 Karma

Builder

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

View solution in original post

0 Karma

New Member

Thank you for helping me on my issue.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!