name: Detect Spike in Security Group Activity
id: ada0f478-84a8-4641-a3f1-e32372d4bd53
version: 1
date: '2018-04-18'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search will detect users creating spikes in API activity related
  to security groups in your AWS environment.  It will also update the cache file
  that factors in the latest data.  This search is deprecated and have been translated
  to use the latest Change Datamodel.
search: '`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_group_api_calls`
  | spath output=arn path=userIdentity.arn | stats count as apiCalls by arn | inputlookup
  security_group_activity_baseline append=t | fields - latestCount | stats values(*)
  as * by arn | rename apiCalls as latestCount | eval newAvgApiCalls=avgApiCalls +
  (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
  2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval avgApiCalls=coalesce(newAvgApiCalls,
  avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount),
  numDataPoints, numDataPoints+1) | table arn, latestCount, numDataPoints, avgApiCalls,
  stdevApiCalls | outputlookup security_group_activity_baseline | eval dataPointThreshold
  = 15, deviationThreshold = 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
  AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn as
  userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
  | stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
  as uniqueApisCalled by user | `detect_spike_in_security_group_activity_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
  your environment. The `dataPointThreshold` variable is the minimum number of data
  points required to have a statistically significant amount of data to determine.
  The `deviationThreshold` variable is the number of standard deviations away from
  the mean that the value must be to be considered a spike.This search works best
  when you run the "Baseline of Security Group Activity by ARN" support search once
  to create a history of previously seen Security Group Activity. To add or remove
  API event names for security groups, edit the macro `security_group_api_calls`.
known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`,
  the false positive rate may vary. Please modify this according the your environment.
references: []
tags:
  analytic_story:
  - AWS User Monitoring
  asset_type: AWS Instance
  cis20:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1078.004
  nist:
  - DE.DP
  - DE.CM
  - PR.AC
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - serIdentity.arn
  risk_object: user
  risk_object_type: user
  risk_score: 5
  security_domain: network
