Volume of network traffic from one user

You might want to look at the volume of traffic related to a certain user's network connections when doing the following:

• Monitoring for network traffic volume outliers

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

While monitoring your network traffic for volume outliers, excessive data from one user catches your eye. You want to investigate that user's activity.

1. Run the following search:
   

sourcetype="pan:traffic" (src_ip=<IP address of user> OR dest_ip=<IP address of user>)
| stats count AS event_count sum(bytes_in) AS bytes_in sum(bytes_out) AS bytes_out sum(bytes) as bytes_total by src_ip dest_ip
| eval mb_in=round((bytes_in/1024/1024),2)  
| eval mb_out=round((bytes_out/1024/1024),2) 
| eval mb_total=round((bytes_total/1024/1024),2)
| fields - bytes*
| sort - mb_total
| head 10

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The results show the top 10 talkers between the user under investigation and other systems. You can investigate the connections and drill further into each of them as needed.