From 24128d49821fd4ad9246cd252f3dcb0497632410 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 13 Jan 2021 15:34:24 -0800 Subject: [PATCH 1/4] updating lookup name to avoid duplicates and deprecattion --- baselines/previously_seen_users_in_cloudtrail.yml | 6 +++--- .../update_previously_seen_users_in_cloudtrail.yml | 8 ++++---- .../cloud/detect_aws_console_login_by_new_user.yml | 5 ++--- ...tect_aws_console_login_by_user_from_new_city.yml | 13 ++++++------- ...t_aws_console_login_by_user_from_new_country.yml | 12 ++++++------ ...ct_aws_console_login_by_user_from_new_region.yml | 11 ++++++----- .../detect_new_user_aws_console_login.yml | 4 ++-- 7 files changed, 29 insertions(+), 30 deletions(-) rename detections/{cloud => deprecated}/detect_new_user_aws_console_login.yml (95%) diff --git a/baselines/previously_seen_users_in_cloudtrail.yml b/baselines/previously_seen_users_in_cloudtrail.yml index f98d74025b..b786a501b1 100644 --- a/baselines/previously_seen_users_in_cloudtrail.yml +++ b/baselines/previously_seen_users_in_cloudtrail.yml @@ -5,16 +5,16 @@ date: '2018-04-30' description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 - days. + days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Please validate the user name entries in `previously_seen_users_console_logins`, + inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. author: Jason Brewer, Splunk search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region - Country | outputlookup previously_seen_users_console_logins | stats count' + Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count' tags: analytics_story: - Suspicious AWS Login Activities diff --git a/baselines/update_previously_seen_users_in_cloudtrail.yml b/baselines/update_previously_seen_users_in_cloudtrail.yml index 40f57f9ef1..ecd41e4bfe 100644 --- a/baselines/update_previously_seen_users_in_cloudtrail.yml +++ b/baselines/update_previously_seen_users_in_cloudtrail.yml @@ -4,18 +4,18 @@ version: 1 date: '2018-04-30' description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country - we have encountered this user in our dataset, grouped by ARN, within the last hour. + we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. Please validate the user name entries in `previously_seen_users_console_logins`, + inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. author: Jason Brewer, Splunk search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region - Country | inputlookup append=t previously_seen_users_console_logins | stats + Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country - | outputlookup previously_seen_users_console_logins' + | outputlookup previously_seen_users_console_logins_cloudtrail' tags: analytics_story: - Suspicious AWS Login Activities diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index 4f972ea968..b14d09fe5f 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -9,9 +9,8 @@ description: This search looks for CloudTrail events wherein a console login eve the last hour how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates - to the Authentication data model for cloud use cases. Run the `Previously Seen Users - in CloudTrail` support search only once to create a baseline of previously seen - IAM users within the last 30 days. Run `Update previously seen users in CloudTrail` + to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen + IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. type: ESCU diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 2d9ff5c6de..38f3b42f23 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -7,13 +7,12 @@ description: This search looks for CloudTrail events wherein a console login eve file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud - provider. You should run the baseline search `Previously seen users in CloudTrail - - Initial` to build the initial table of source IP address, geographic locations, - and times. You must also enable the second baseline search `Previously Seen users - in Cloudtrail - Update` to keep this table up to date and to age out old data. You - can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` - macro. +how_to_implement: You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen + IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` + hourly (or more frequently depending on how often you run the detection searches) + to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro. type: ESCU author: Bhavin Patel, Splunk search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 1b021ac98b..909b9b8623 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -6,12 +6,12 @@ description: This search looks for CloudTrail events wherein a console login eve by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within - the last hour -how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud - provider. You should run the baseline search `Previously seen users in CloudTrail - - Initial` to build the initial table of source IP address, geographic locations, - and times. You must also enable the second baseline search `Previously Seen users - in Cloudtrail - Update` to keep this table up to date and to age out old data. You + the last hourYou must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen + IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` + hourly (or more frequently depending on how often you run the detection searches) + to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro. type: ESCU diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 713a9b95c6..26eb690c54 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -7,11 +7,12 @@ description: This search looks for CloudTrail events wherein a console login eve file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud - provider. You should run the baseline search `Previously seen users in CloudTrail - - Initial` to build the initial table of source IP address, geographic locations, - and times. You must also enable the second baseline search `Previously Seen users - in Cloudtrail - Update` to keep this table up to date and to age out old data. You +how_to_implement:You must install and configure the Splunk Add-on for AWS (version + 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates + to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen + IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` + hourly (or more frequently depending on how often you run the detection searches) + to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro. type: ESCU diff --git a/detections/cloud/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml similarity index 95% rename from detections/cloud/detect_new_user_aws_console_login.yml rename to detections/deprecated/detect_new_user_aws_console_login.yml index 83ebc38e6e..49b78a6bd8 100644 --- a/detections/cloud/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -6,13 +6,13 @@ description: This search looks for CloudTrail events wherein a console login eve by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within - the last hour + the last hour. Deprecated now this search is updated to use the Authentication datamodel. how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Run the "Previously seen users in CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in CloudTrail" hourly (or more frequently depending on how - often you run the detection searches) to refresh the baselines. + often you run the detection searches) to refresh the baselines. type: ESCU author: Bhavin Patel, Splunk search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | stats From acd855474bb39ffd5f4e4fe1df826e1b69ffdf4b Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 13 Jan 2021 15:49:03 -0800 Subject: [PATCH 2/4] minor --- .../cloud/detect_aws_console_login_by_user_from_new_region.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index 26eb690c54..10b5d3d619 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -7,7 +7,7 @@ description: This search looks for CloudTrail events wherein a console login eve file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -how_to_implement:You must install and configure the Splunk Add-on for AWS (version +how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` From c5e6238e20f90558473ac4f19525983bc0595f3a Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 13 Jan 2021 17:21:27 -0800 Subject: [PATCH 3/4] updated lookup name --- detections/deprecated/detect_new_user_aws_console_login.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml index 49b78a6bd8..8879b9c41b 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -17,7 +17,7 @@ type: ESCU author: Bhavin Patel, Splunk search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | stats earliest(_time) as firstTime latest(_time) as lastTime by user | inputlookup append=t - previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) + previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >= relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter`' From 549fb5d197733fbaa2465be9d34484a25bab94b3 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 21 Jan 2021 11:39:57 -0800 Subject: [PATCH 4/4] minor text --- .../detect_aws_console_login_by_user_from_new_country.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 909b9b8623..00e2819d0e 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -6,7 +6,8 @@ description: This search looks for CloudTrail events wherein a console login eve by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within - the last hourYou must install and configure the Splunk Add-on for AWS (version + the last hour +how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update`