admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixes issue 343

Browse Source
This commit is contained in:
divious1
2020-02-07 13:32:56 -05:00
parent 98195728fc
commit 3336663726
1 changed files with 18 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/ec2_instance_started_with_previously_unseen_instance_type.yml
+18 -12
View File
@@ -31,15 +31,21 @@ detect:
cron_schedule: 0 * * * *
earliest_time: -70m@m
latest_time: -10m@m
search: sourcetype=aws:cloudtrail eventName=RunInstances [search sourcetype=aws:cloudtrail
eventName=RunInstances errorCode=success | fillnull value="m1.small" requestParameters.instanceType
search: sourcetype=aws:cloudtrail eventName=RunInstances
[search sourcetype=aws:cloudtrail eventName=RunInstances errorCode=success
| fillnull value="m1.small" requestParameters.instanceType
| stats earliest(_time) as earliest latest(_time) as latest by requestParameters.instanceType
| rename requestParameters.instanceType as instanceType | inputlookup append=t
previously_seen_ec2_instance_types.csv | stats min(earliest) as earliest max(latest)
as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv
| eval newType=if(earliest >= relative_time(now(), "-70m@m"), 1, 0) | convert
security_content_ctime(earliest) security_content_ctime(latest) | where newType=1 | rename instanceType as requestParameters.instanceType
| table requestParameters.instanceType] | spath output=user userIdentity.arn
| rename requestParameters.instanceType as instanceType
| inputlookup append=t previously_seen_ec2_instance_types.csv
| stats min(earliest) as earliest max(latest) as latest by instanceType
| outputlookup previously_seen_ec2_instance_types.csv
| eval newType=if(earliest >= relative_time(now(), "-70m@m"), 1, 0)
| `security_content_ctime(earliest)`
| `security_content_ctime(latest)`
| where newType=1
| rename instanceType as requestParameters.instanceType
| table requestParameters.instanceType]
| spath output=user userIdentity.arn
| rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId
as dest | table _time, user, dest, instanceType
suppress:
@@ -67,14 +73,14 @@ known_false_positives: It is possible that an admin will create a new system usi
to create the system with the new instance type.
maintainers:
- company: Splunk
email: davidd@splunk.com
name: David Dorsey
email: jhernandez@splunk.com
name: Jose Hernandez
mappings:
cis20:
- CIS 1
nist:
- ID.AM
modification_date: '2018-03-12'
modification_date: '2020-02-07'
name: EC2 Instance Started With Previously Unseen Instance Type
original_authors:
- company: Splunk
@@ -84,4 +90,4 @@ references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '1.0'
version: '2.0'