flâneur

SIEM Hyper Queries: introduction, current detection methods (part I/II) | by Alex Teixeira | Detect FYI

detect.fyi · 1,565 words · saved by 1 readers

The Splunk language is very powerful. I've been writing SPL for years and I still keep discovering new ways to use it, especially when browsing the docs or the community forums trying to solve another problem. This year, I've published a query for detecting multiple flavors of password brute-force attacks using streamstats command. That query is leveraging some of the characteristics of what I am calling a Splunk Hyper Query. Hyper- is a prefix from Greek meaning “over,” usually implying excess or exaggeration (hyperbole). In a similar way, a SIEM hyper query (overly) performs multiple checks and iterations over the event stream before providing results back. The idea is to capture as many signals as possible from within one single query. In this post I'm going to provide an overview of the thought process I use to craft those queries, which applies to many high-value detection use cases (suspicious command line sessions, suspicious web proxy sessions, etc). From here, please assume we

SIEM Hyper Queries: introduction, current detection methods (part I/II) Alex Teixeira 7 min read · Jun 14, 2021 -- 1 Listen Share The Splunk language is very powerful. I've been writing SPL for years and I still keep discovering new ways to use it, especially when browsing the docs or the community forums trying to solve another problem. This year, I've published a query for detecting multiple flavors of password brute-force attacks using streamstats command. That query is leveraging some of the characteristics of what I am calling a Splunk Hyper Query . So what's a Hyper Query? Hyper - is a p

related reading