admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Slight search tweak and another text updates

Browse Source
This commit is contained in:
Rico Valdez
2019-05-09 10:54:36 -06:00
parent 12be9cdacc
commit d8aac902fb
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/train_smb_traffic_spike.json
+3 -3
View File
@@ -13,8 +13,8 @@
"Bro"
]
},
"eli5": "Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that can be indicative of attackers scanning or attempting to propagate to other systems in your environment.",
"how_to_implement": "To successfully implement this search, you must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.",
"eli5": "Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that can be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data, and profiles the number of SMB connections in your environemnt by the hour of day and day of week the connections occur.",
"how_to_implement": "To successfully implement this search, you must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding \"src\" to thy by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. If you do so, you may need to raise the value of max_inputs and/or max_groups\u00a0in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.",
"maintainers": [
{
"company": "Splunk",
@@ -34,7 +34,7 @@
"earliest_time": "-31d@d",
"latest_time": "-1d@d"
},
"search": "| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek,src\" into smb_pdfmodel",
"search": "| tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, \"%H\") | eval DayOfWeek=strftime(_time, \"%A\") | `drop_dm_object_name(\"All_Traffic\")` | fit DensityFunction count by \"HourOfDay,DayOfWeek\" into smb_pdfmodel",
"search_description": "This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the number of SMB connections for that hour and day of the week.",
"search_id": "df98763b-0b08-4281-8ef9-08db7ac572a9",
"search_name": "Model Builder For \"SMB Traffic Spike - MLTK\"",