Using Anomaly Detection Plugin to Identify External IP Log Entries

Plugins Security Analytics
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 2.8 with Dashboard.

Describe the issue:
Sure, here’s a suggested way to phrase your question to the OpenSearch community:

Title: Using Anomaly Detection Plugin to Identify External IP Log Entries

Hi everyone,

I’m currently working with OpenSearch and would like to leverage the anomaly detection plugin to monitor and identify log entries from IP addresses that fall outside a specified subnet. Specifically, I want to detect anomalies when logs are received from IP addresses that are not part of a given internal subnet (e.g., 192.168.0.0/24).

Could anyone provide guidance or examples on how to set up and configure the anomaly detection plugin to achieve this? Any advice on best practices, potential pitfalls, or alternative approaches would also be greatly appreciated.

Thank you!

2

Anomaly detector can only analyze keyword type or numeric type field, may not analyze ip type field, so for ip type field, you can try using alerting plugin directly, create an buckets monitor, if there’re some unexpected ip addresses, trigger an alert:

PUT testindex 
{
  "mappings" : {
    "properties" :  {
      "ip_address" : {
        "type" : "ip"
      }
    }
  }
}

PUT testindex/_doc/1 
{
  "ip_address" : "10.24.34.0"
}

PUT testindex/_doc/2
{
  "ip_address" : "192.168.0.1"
}


GET testindex/_search
{
  "size": 0,
  "aggs": {
    "access": {
      "ip_range": {
        "field": "ip_address",
        "ranges": [
          { "to": "192.168.0.0" },
          { "from": "192.168.255.0" }
        ]
      }
    }
  }
}

, the response of the ip_range aggregation shows that there’s an unexpected ip which is not in the subnet 192.168.0.0/24:

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 2,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "access": {
      "buckets": [
        {
          "key": "*-192.168.0.0",
          "to": "192.168.0.0",
          "doc_count": 1
        },
        {
          "key": "192.168.255.0-*",
          "from": "192.168.255.0",
          "doc_count": 0
        }
      ]
    }
  }
}
3

Hey,

I am new to opensearch, can please completely guide me through the process. I saw Per bucket monitor and got confused in how to write triggers and actions for the task i mentioned.

Regards,
Aarav

4

You can check the documentation of alerting for more details: Alerting - OpenSearch Documentation.

5

Thank you for the guidance. This is all static, what should i do in case I wanted to do this dyanamically.

6

You can all the alerting API: API - OpenSearch Documentation.

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.