Best Practices for Detecting Data Exfiltration with Firewall Logs

firewall/network log’s bytes IN / OUT, combined with whitelists / watchlists might be a starting point.

next tier might be signals from specific exfiltration/DLP/IRM solutions.

Coming back to the bytes OUT, density functions might be used for anomaly detection, regression to predict expected traffic and clustering k-means for peer group analysis. But they are quite advanced ML algorithms, often require a lot of tunning / training, and honestly not sure if they are available out of the box in Secops, otherwise you might have to switch to bigquery.

In Secops, it might be a good idea to take a look on the Curated Detections > built-in Risk Analytics. There’s a series of “Anomalous Network Bytes Outbound By” / “Anomalous Total Bytes by” rules, based on thresholds calculated using avg and 2x sdddev that might be suitable.

Similarly this recent multi stage writeup on outliers from jstoner might also help, applied to bytes OUT and scoped exfiltration destinations

Thanks a lot, super helpful reply!

I checked the Curated Detections in SecOps and found rules like “Anomalous Network Bytes Outbound By Hostname/ Mac Address...etc”,

I’ll try enabling/testing them to see how they behave in our environment.

Really appreciate the guidance

This is such a tough problem, I feel you! The noise from all that legitimate outbound traffic is the worst part.

From my experience, combining both behavioral anomalies and destination rules works best. We baseline “normal” outbound volume per user/IP, then flag sudden spikes, and also watch for traffic to known risky destinations (like unregistered cloud storage, or TOR endpoints).

Tuning false positives takes forever, but we found that grouping traffic by business use (like “Microsoft 365 only” or “video streaming”) helps cut through the noise a lot.