name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
version: 3
date: '2021-01-26'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for a spike in number of of AWS security Hub alerts
  for an EC2 instance in 4 hours intervals
search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
  _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account)
  as vendor_account values(vendor_region) as vendor_region values(severity) as severity
  by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev
  | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev
  * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
  vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
  Hub inputs. The threshold_value should be tuned to your environment and schedule
  these searches according to the bucket span interval.
known_false_positives: None
references: []
tags:
  analytic_story:
  - AWS Security Hub Alerts
  asset_type: AWS Instance
  automated_detection_testing: passed
  cis20:
  - CIS 13
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Resources{}.Type
  - Title
  - Types{}
  - vendor_account
  - vendor_region
  - severity
  - dest
  security_domain: network
