name: Create a list of approved AWS service accounts
id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
version: 2
date: '2018-12-03'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for successful API activity in CloudTrail within the
  last 30 days, filters out known users from the identity table, and outputs values
  of users into `aws_service_accounts.csv` lookup file.
search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
  [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
  | table identity | outputlookup aws_service_accounts | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. Please validate the service account entires in `aws_service_accounts.csv`,
  which is a lookup file created as a result of running this support search. Please
  remove the entries of service accounts that are not legitimate.
references: []
tags:
  analytic_story:
  - AWS User Monitoring
  detections:
  - Detect AWS API Activities From Unapproved Accounts
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
