name: Detect Spike in AWS Security Hub Alerts for User
id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222
version: 3
date: '2021-01-26'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for a spike in number of of AWS security Hub alerts
  for an AWS IAM User in 4 hours intervals.
search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | rename
  findings{}.Resources{}.Id as user | bucket span=4h _time | stats count AS alerts
  by _time user | eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev
  | eval threshold_value = 2 | eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev
  * threshold_value), 1, 0) | search isOutlier=1 | table _time user alerts |`detect_spike_in_aws_security_hub_alerts_for_user_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
  Hub inputs. The threshold_value should be tuned to your environment and schedule
  these searches according to the bucket span interval.
known_false_positives: None
references: []
tags:
  analytic_story:
  - AWS Security Hub Alerts
  asset_type: AWS Instance
  cis20:
  - CIS 13
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - findings{}.Resources{}.Type
  - indings{}.Resources{}.Id
  - user
  security_domain: network
