What problem does it solve?
SOC teams struggle to identify compromised accounts and insider threats that evade rule-based detection. This Skill builds behavioral baselines from 30-90 days of authentication and access logs, then flags deviations like impossible travel, off-hours logins, abnormal data access volumes, and privilege abuse.
Core Features & Use Cases
- Behavioral Baselining: Builds per-user statistical profiles (login hours, IPs, countries, apps) from historical SIEM data using Splunk SPL queries.
- Anomaly Detection: Detects impossible travel via GeoIP distance/speed calculations, off-hours access via baseline deviation, data exfiltration via z-score analysis, and privilege abuse via host-count anomalies.
- Risk Scoring: Aggregates multiple anomaly signals into a composite risk score weighted by user priority for investigation prioritization.
- Use Case: A SOC analyst suspects credential compromise after unusual O365 login alerts. Run the impossible travel and off-hours detection queries to confirm a login from Moscow two hours after a New York login, then escalate with a composite risk score.
Quick Start
Use this skill to build user behavior baselines from the last 30 days of authentication logs and flag any impossible travel or anomalous login activity in the past 24 hours.
