name: Suspicious AWS S3 Activities
id: 2e8948a5-5239-406b-b56b-6c50w3168af3
version: 2
date: '2018-07-24'
author: Bhavin Patel, Splunk
type: batch
description: Use the searches in this Analytic Story to monitor your AWS S3 buckets
  for evidence of anomalous activity and suspicious behaviors, such as detecting open
  S3 buckets and buckets being accessed from a new IP. The contextual and investigative
  searches will give you more information, when required.
narrative: 'As cloud computing has exploded, so has the number of creative attacks
  on virtual environments. And as the number-two cloud-service provider, Amazon Web
  Services (AWS) has certainly had its share.\

  Amazon''s "shared responsibility" model dictates that the company has responsibility
  for the environment outside of the VM and the customer is responsible for the security
  inside of the S3 container. As such, it''s important to stay vigilant for activities
  that may belie suspicious behavior inside of your environment.\

  Among things to look out for are S3 access from unfamiliar locations and by unfamiliar
  users. Some of the searches in this Analytic Story help you detect suspicious behavior
  and others help you investigate more deeply, when the situation warrants.   '
references:
- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
- https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/
tags:
  analytic_story: Suspicious AWS S3 Activities
  category:
  - Cloud Security
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Security Monitoring
