name: Previously Seen Cloud API Calls Per User Role - Initial
id: 69d75f4b-b794-4a66-a777-730357b886b4
version: 1
date: '2020-09-03'
author: David Dorsey, Splunk
type: batch
datamodel:
- Change
description: This search builds a table of the first and last times seen for every
  user role and command combination. This is broadly defined as any event that runs
  or creates something. This table is then cached.
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen
  from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success
  by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
  | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime
  <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen,
  enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role'
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud
  provider.
references: []
tags:
  analytic_story:
  - Suspicious Cloud User Activities
  deployments:
  - 90 Day Baseline
  detections:
  - Cloud API Calls From Previously Unseen User Roles
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
