name: Detect AWS API Activities From Unapproved Accounts
id: ada0f478-84a8-4641-a3f1-d82362d4bd55
version: 2
date: '2020-07-21'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for successful CloudTrail activity by user accounts
  that are not listed in the identity table or `aws_service_accounts.csv`. It returns
  event names and count, as well as the first and last time a specific user or service
  is detected, grouped by users. Deprecated because managing this list can be quite
  hard.
search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
  [| inputlookup identity_lookup_expanded | fields identity] | search NOT [| inputlookup
  aws_service_accounts | fields identity] | rename identity as user | stats count
  min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName by
  user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `detect_aws_api_activities_from_unapproved_accounts_filter`'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. You must also populate the `identity_lookup_expanded` lookup shipped with
  the Asset and Identity framework to be able to look up users in your identity table
  in Enterprise Security (ES). Leverage the support search called "Create a list of
  approved AWS service accounts": run it once every 30 days to create and validate
  a list of service accounts.\

  This search produces fields (`eventName`,`firstTime`,`lastTime`) that are not yet
  supported by ES Incident Review and therefore cannot be viewed when a notable event
  is raised. These fields contribute additional context to the notable. To see the
  additional metadata, add the following fields, if not already present, to Incident
  Review - Event Attributes (Configure > Incident Management > Incident Review Settings
  > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\

  1. \

  1. **Label:** First Time, **Field:** firstTime\

  1. \

  1. **Label:** Last Time, **Field:** lastTime\

  Detailed documentation on how to create a new field within Incident Review may be
  found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
known_false_positives: It's likely that you'll find activity detected by users/service
  accounts that are not listed in the `identity_lookup_expanded` or ` aws_service_accounts.csv`
  file. If the user is a legitimate service account, update the `aws_service_accounts.csv`
  table with that entry.
references: []
tags:
  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Instance
  cis20:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1078.004
  nist:
  - DE.DP
  - DE.CM
  - PR.AC
  - ID.AM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - errorCode
  - userName
  - eventName
  - user
  risk_object: user
  risk_object_type: user
  risk_score: 15
  security_domain: access
