Splunk unknown experimental spl

Kubernetes Anomalous Inbound Outbound Network IO

The following analytic identifies high inbound or outbound network I/O anomalies in Kubernetes containers. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. A lookup table with average and standard deviation values for network I/O is used to detect anomalies persisting over a 1-hour period. This activity is significant as it may indicate data exfiltration, command and control communication, or unauthorized data transfers. If confirmed malicious, it could lead to data breaches, service outages, financial losses, and reputational damage.

View Source

Detection Logic

| mstats avg(k8s.pod.network.io) as io where `kubernetes_metrics` by k8s.cluster.name k8s.pod.name k8s.node.name direction span=10s
| eval service = replace('k8s.pod.name', "-\w{5}$$
| -[abcdef0-9]{8,10}-\w{5}$$", "")
| stats avg(eval(if(direction="transmit", io,null()))) as outbound_network_io avg(eval(if(direction="receive", io,null()))) as inbound_network_io by k8s.cluster.name k8s.node.name k8s.pod.name service _time
| eval key = 'k8s.cluster.name' + ":" + 'service'
| lookup k8s_container_network_io_baseline key
| eval anomalies = ""
| foreach stdev_* [ eval anomalies =if( '<<MATCHSTR>>' > ('avg_<<MATCHSTR>>' + 4 * 'stdev_<<MATCHSTR>>'), anomalies + "<<MATCHSTR>> higher than average by " + tostring(round(('<<MATCHSTR>>' - 'avg_<<MATCHSTR>>')/'stdev_<<MATCHSTR>>' ,2)) + " Standard Deviations. <<MATCHSTR>>=" + tostring('<<MATCHSTR>>') + " avg_<<MATCHSTR>>=" + tostring('avg_<<MATCHSTR>>') + " 'stdev_<<MATCHSTR>>'=" + tostring('stdev_<<MATCHSTR>>') + ", " , anomalies) ]
| eval anomalies = replace(anomalies, ",\s$$", "")
| where anomalies!=""
| stats count values(anomalies) as anomalies by k8s.cluster.name k8s.node.name k8s.pod.name service
| rename service as k8s.service
| where count > 5
| rename k8s.node.name as host
| `kubernetes_anomalous_inbound_outbound_network_io_filter`

False Positives

⚠ No false positives have been identified at this time.

Field Validations

Loading…

Comments (0)

Loading comments...