News for hackers. Stuff that matters.

A comment on Ask HN: Who is using a self hosted analytics system?. Parent comment

Re:Ask HN: Who is using a self hosted analytics system? by mfrye0 on Tuesday December 06, 2016 @01:57PM (#13117243)
Whoa. That's badass.

Do you pull any info regarding the IP addresses, or is it only the raw logs that you're going through?

[ Parent | on HN ]
Re:Ask HN: Who is using a self hosted analytics system? by gesman on Tuesday December 06, 2016 @04:58PM (#13118693)
Only raw logs. Splunk resolves IP to Country/Region/City (and geo coordinates if wanted to map these).

Mostly playing with raw logs and then even RAW-er logs using Splunk Stream (thing that switches network interface in promiscuous mode and gives me all data for all protocols and any context I ever want).

For example I can analyze anomalies in web hits and anomalies in web session to discover new, previously unknown traffic sources and patterns.

It helped to discover 2 new classes of cyberattacks I didn't know were targeting my server.

[ Parent | on HN ]
Re:Ask HN: Who is using a self hosted analytics system? by mfrye0 on Tuesday December 06, 2016 @08:39PM (#13119847)
Sounds really useful. I'll have to check that out.
[ Parent | on HN ]