What command is used for trying to identify anomaly logons from common users?

[keldridg2]

Is there a website on Splunk docs that describe interesting fields and what each field is about?

What command can I use for Splunk with trying to identify anomaly logons from common users and to be able to point out a spike in logons from one user?

[aokur_splunk]

one idea for detecting a spike or outlier in logons would be to summarize, by user, how often they login.. say # of times a week or day.. you could try for hour but you'll likely get a lot of noise..

start with something like

'index=<security> sourcetype=<logins> |bin span=1d _time | stats count by <user> _time'

Then summary index this data over a recurring period to be able to detect outliers. - try the |collect command

Now apply the standard deviation method of detecting outliers - essentially check if the sample is some standard devs from the mean.
The MLTK toolkit has some fun features for this, some math behind it is:

1. mean logins by user
2. calculate standard deviation
3. test for : (logins < (mean + 2 standard deviations) )
4. if true - this is technically an outlier. you can adjust your standard deviation to experiment
   

Then schedule this search to run over a time period and create an alert if there are results.. or to send you a report

I would check out the MLTK though, lots of great stuff in there.. Security Essentials has a user case for this as well

[solarboyz1 · Accepted solution]

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

[keldridg2]

Thank you for helping me on my issue.