Splunk unknown experimental spl

Kubernetes newly seen UDP edge

The following analytic detects UDP communication between a newly seen source and destination workload pair within a Kubernetes cluster. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. This detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies. If confirmed malicious, unauthorized connections may enable attackers to infiltrate the application ecosystem, leading to data breaches, privilege escalation, lateral movement, or disruption of critical services.

View Source

Detection Logic

| mstats count(udp.packets) as udp.packets_count where `kubernetes_metrics` 
AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name
| eval current="True"
| append [ mstats count(udp.packets) as udp.packets_count where `kubernetes_metrics` 
AND earliest=-30d latest=-1h by source.workload.name dest.workload.name
| eval current="false" ]
| eventstats values(current) as current
  BY source.workload.name dest.workload.name
| search current="true" current!="false"
| rename k8s.cluster.name as host
| `kubernetes_newly_seen_udp_edge_filter`

False Positives

⚠ No false positives have been identified at this time.

Field Validations

Loading…

Comments (0)

Loading comments...