name: Detect Spike in Network ACL Activity
id: ada0f478-84a8-4641-a1f1-e32372d4bd53
version: 1
date: '2018-05-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search will detect users creating spikes in API activity related
  to network access-control lists (ACLs)in your AWS environment. This search is deprecated
  and have been translated to use the latest Change Datamodel.
search: '`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_events`
  | spath output=arn path=userIdentity.arn | stats count as apiCalls by arn | inputlookup
  network_acl_activity_baseline append=t | fields - latestCount | stats values(*)
  as * by arn | rename apiCalls as latestCount | eval newAvgApiCalls=avgApiCalls +
  (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
  2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval avgApiCalls=coalesce(newAvgApiCalls,
  avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount),
  numDataPoints, numDataPoints+1) | table arn, latestCount, numDataPoints, avgApiCalls,
  stdevApiCalls | outputlookup network_acl_activity_baseline | eval dataPointThreshold
  = 15, deviationThreshold = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
  AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn as
  userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
  | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
  as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
  your environment. The `dataPointThreshold` variable is the minimum number of data
  points required to have a statistically significant amount of data to determine.
  The `deviationThreshold` variable is the number of standard deviations away from
  the mean that the value must be to be considered a spike. This search works best
  when you run the "Baseline of Network ACL Activity by ARN" support search once to
  create a lookup file of previously seen Network ACL Activity. To add or remove API
  event names related to network ACLs, edit the macro `network_acl_events`.
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold`
  and `deviationThreshold`. Please modify this according the your environment.
references: []
tags:
  analytic_story:
  - AWS Network ACL Activity
  asset_type: AWS Instance
  cis20:
  - CIS 12
  - CIS 11
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1562.007
  nist:
  - DE.DP
  - DE.CM
  - PR.AC
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - userIdentity.arn
  risk_object: user
  risk_object_type: user
  risk_score: 20
  security_domain: network
