Unsupervised Machine Learning with Splunk: the cluster command | by Alex Teixeira | Detect FYI

There are known knowns. There are things we know we know. We also know there are known unknowns. That is to say, we know there are some things we do not know. But there are also unknown unknowns, the ones we don’t know we don’t know. Secretary of Defense Donald Rumsfeld, 2002 To pick a use case from that, let's focus on web browsers for a moment. In large-scale environments, there might be thousands, if not, millions of new, unique HTTP User Agent (browser) strings every day. The issue is that it's not possible to simply pattern-match every new malicious browser string (Known Known). So what can be done instead? Splunk does provide commands such as stats, rare and top, which allow users to organize results based on least or most frequent values. However, simply stack counting (simple frequency analysis) does not apply to all cases, especially when the distinction lies in very small details. In this quick article I will introduce a simple yet powerful clustering technique available for

Unsupervised Machine Learning with Splunk: the cluster command Alex Teixeira 7 min read · Feb 19, 2024 -- 2 Listen Share If you are in cyber for long, you should have probably heard this one: There are known knowns . There are things we know we know. We also know there are known unknowns . That is to say, we know there are some things we do not know. But there are also unknown unknowns , the ones we don’t know we don’t know. Secretary of Defense Donald Rumsfeld , 2002 To pick a use case from that, let's focus on web browsers for a moment. In large-scale environments, there might be thousands,

saved by

• Cooper Edmunds

related reading

• Risk-Based Alerting: The New Frontier for SIEM | Splunksplunk.com
• The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework | Splunksplunk.com
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• Baseline Hunting with the PEAK Framework | Splunksplunk.com
• Introducing the PEAK Threat Hunting Framework | Splunksplunk.com
• Navigating the crossroads of Threat Hunting & Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labssecuritylabs.datadoghq.com
• Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Mediummedium.com
• How rare is a rare HTTP agent? Context-rich alerts because of math – Opstune.comopstune.com
• Mediumdetect.fyi
• Elevating Security Intelligence with Splunk UBA's Machine Learning Models | Splunksplunk.com