Splunk ES ML detection

| mlspl anomalydetection <field>

Train an anomaly detection model in Splunk ES (mlspl anomalydetection), detecting deviations that rules do not see.

Use it when you want anomaly detection in Splunk: mlspl anomalydetection trains the model on the specified field (volume of logons per user, bytes of connections) and scores events by their rarity — the deviation from the baseline as a signal. It is the complementary detection to rules: anomalous behavior that a fixed threshold does not distinguish. In purple teaming and detection engineering, Splunk ML is applied to cases where rules fail (variable volume) — the model is trained with the baseline and validated with exercise data.

Do not use it without baseline data: the model learns from history — without weeks of clean data, the model becomes contaminated and anomalies mean nothing. Splunk ML is expensive (training and scoring): it is applied to specific cases, not to everything. And beware: statistical anomaly is not an attack — the model flags, the analyst decides; alerting on every deviation generates noise. For most detections, the rule with threshold is the option; ML is for cases where it does not work. Validation with the purple team (atomics that generate anomalous behavior) confirms that the model detects it.