Alerting

How to write a search to alert on anomalous network traffic?

andre_tucker
Path Finder

I would like to be able to take a general baseline of packet count by source IP address (internal) and source port during a particular point in time and alert when a single IP has a single source port whose count is greater than several standard deviations outside the norm. What would be the most efficient way of doing this? I should also note that I will only be looking at ports between 49,000 and 65535.

0 Karma
1 Solution

tjr1775
Path Finder

The easiest and most efficient way to do this is with the Machine Learning Toolkit app. you would select "Detect Numeric Outliers" and then you would write your base search simply as:

sourcetype=xxx (src_port > 49000 AND src_port < 65535), and then select the fields you would like to conduct outlier detection on.

See the screenshot below. You can write normal Splunk alerts from there on the results. That would definitely be the easiest and most efficient. It has all your needed functionality built-in.

alt text

View solution in original post

tjr1775
Path Finder

The easiest and most efficient way to do this is with the Machine Learning Toolkit app. you would select "Detect Numeric Outliers" and then you would write your base search simply as:

sourcetype=xxx (src_port > 49000 AND src_port < 65535), and then select the fields you would like to conduct outlier detection on.

See the screenshot below. You can write normal Splunk alerts from there on the results. That would definitely be the easiest and most efficient. It has all your needed functionality built-in.

alt text

tjr1775
Path Finder

Couple questions- 1) how many unique internal (source) IPs do you have, 2) how long do you want to go back for your historical baseline (30 days? 60 days? 90?), 3) are you dead set on 2x stdev as an outlier detector?, and lastly, 4) do you have the capability to download/install/use the Splunk Machine Learning Toolkit?

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...