Splunk Search

What command is used for trying to identify anomaly logons from common users?

keldridg2
New Member

Is there a website on Splunk docs that describe interesting fields and what each field is about?

What command can I use for Splunk with trying to identify anomaly logons from common users and to be able to point out a spike in logons from one user?

0 Karma
1 Solution

solarboyz1
Builder

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

View solution in original post

0 Karma

aokur_splunk
Splunk Employee
Splunk Employee

one idea for detecting a spike or outlier in logons would be to summarize, by user, how often they login.. say # of times a week or day.. you could try for hour but you'll likely get a lot of noise..

start with something like

'index=<security> sourcetype=<logins> |bin span=1d _time | stats count by <user> _time'

Then summary index this data over a recurring period to be able to detect outliers. - try the |collect command

Now apply the standard deviation method of detecting outliers - essentially check if the sample is some standard devs from the mean.
The MLTK toolkit has some fun features for this, some math behind it is:

  1. mean logins by user
  2. calculate standard deviation
  3. test for : (logins < (mean + 2 standard deviations) )
  4. if true - this is technically an outlier. you can adjust your standard deviation to experiment

Then schedule this search to run over a time period and create an alert if there are results.. or to send you a report

I would check out the MLTK though, lots of great stuff in there.. Security Essentials has a user case for this as well

0 Karma

solarboyz1
Builder

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

0 Karma

keldridg2
New Member

Thank you for helping me on my issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...