Splunk Search

What command is used for trying to identify anomaly logons from common users?

keldridg2
New Member

Is there a website on Splunk docs that describe interesting fields and what each field is about?

What command can I use for Splunk with trying to identify anomaly logons from common users and to be able to point out a spike in logons from one user?

0 Karma
1 Solution

solarboyz1
Builder

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

View solution in original post

0 Karma

aokur_splunk
Splunk Employee
Splunk Employee

one idea for detecting a spike or outlier in logons would be to summarize, by user, how often they login.. say # of times a week or day.. you could try for hour but you'll likely get a lot of noise..

start with something like

'index=<security> sourcetype=<logins> |bin span=1d _time | stats count by <user> _time'

Then summary index this data over a recurring period to be able to detect outliers. - try the |collect command

Now apply the standard deviation method of detecting outliers - essentially check if the sample is some standard devs from the mean.
The MLTK toolkit has some fun features for this, some math behind it is:

  1. mean logins by user
  2. calculate standard deviation
  3. test for : (logins < (mean + 2 standard deviations) )
  4. if true - this is technically an outlier. you can adjust your standard deviation to experiment

Then schedule this search to run over a time period and create an alert if there are results.. or to send you a report

I would check out the MLTK though, lots of great stuff in there.. Security Essentials has a user case for this as well

0 Karma

solarboyz1
Builder

Selected fields, are the standard _time, host, sourcetype, and any fields you specified in your search

Interesting fields, are the other fields extracted from the events returned by your search.

The information on the fields extracted from the events, if available, would be found in the documentation of the add-on use to extract the fields.

0 Karma

keldridg2
New Member

Thank you for helping me on my issue.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...