author: David Dorsey, Splunk
date: '2018-03-19'
description: This search retrieves all the activity from a specific geographic region
  and will create a table containing the time, geographic region, ARN, username, the
  type of user, the source IP address, the AWS region the activity was in, the API
  called, and whether or not the API call was successful.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
id: 5b794bef-1743-4f6f-804a-43915a2702ff
inputs:
- Region
name: Get All AWS Activity From Region
search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search
  Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName
  path=userIdentity.userName | spath output=userType path=userIdentity.type | rename
  sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip,
  awsRegion, eventName, errorCode'
tags:
  analytic_story:
  - AWS Suspicious Provisioning Activities
  product:
  - Splunk Phantom
type: response
version: 1
