monitoring for data exfiltration

[y0d4a]

Hi,

Is it possible to monitor data transfer volumes per IP address and set up alerts for deviations from normal patterns?
The goal is to detect unusual traffic, specifically potential data exfiltration.

Thanks.

[mmguero]

I think this sounds like a good fit for OpenSearch Dashboards' Anomaly Detection feature. I think I would start by creating a detector on network.bytes and then create a bucket probably on source.ip or maybe related.ip. See the opensearch dashboards and opensearch documentation for more info.

Note that, in my experience at least, since this model is self-training, determining the baseline takes at least a couple of weeks' worth of data before you start getting useful anomalies. But once it's been running for a while on your data set it becomes pretty accurate.

[y0d4a]

thank you for suggestion, will try, cheers!