Spikes in printer activity in a Windows environment

Data required

Microsoft: Windows event logs

Procedure

1. Verify that you deployed the Splunk Add-on for Microsoft Windows to the search heads and Splunk Universal Forwarders on the monitored systems. For more information, see About installing Splunk add-ons.
2. Enable the WinPrintMon://job input.
3. Run the following search. You can optimize it by specifying an index and adjusting the time range.

sourcetype=WinPrintMon 
|bucket _time span=1d 
|stats sum(page_printed) AS Pages BY user _time 
|eventstats max(_time) AS maxtime 
|stats count AS num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), 'Pages',null))) AS "Pages" avg(eval(if(_time<relative_time(maxtime,"-1d@d"),'Pages',null))) AS avg stdev(eval(if(_time<relative_time(maxtime,"-1d@d"),'Pages',null))) AS stdev BY user 
|eval lowerBound=(avg-stdev*1), upperBound=(avg+stdev*1) 
|eval isOutlier=if(('Pages' < lowerBound OR 'Pages' > upperBound) AND num_data_samples >=7, 1, 0) 
|table user num_data_samples Pages avg lowerBound upperBound isOutlier

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Next steps

The search shows some useful techniques for comparing current rates of change to past rates of change and could be a framework for other basic predictive searches. It might be interesting to correlate this behavior to a watchlist that contains the user IDs of personnel who are considered higher risk: contractors, new employees, employees that never go on vacation, and employees with access to particularly sensitive data. In the sample data below, the large number of pages printed by Chuck could be indicative of risky user behavior.

Finally, you might want to look at additional searches in Managing printers in a Windows environment.