From 33366637260ffffe952fa7fb402b3f8d029bbfce Mon Sep 17 00:00:00 2001 From: divious1 Date: Fri, 7 Feb 2020 13:32:56 -0500 Subject: [PATCH] fixes issue 343 --- ...d_with_previously_unseen_instance_type.yml | 30 +++++++++++-------- 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/detections/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/ec2_instance_started_with_previously_unseen_instance_type.yml index c7bdc8dfcb..d4a2913c5f 100644 --- a/detections/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/detections/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -31,15 +31,21 @@ detect: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m - search: sourcetype=aws:cloudtrail eventName=RunInstances [search sourcetype=aws:cloudtrail - eventName=RunInstances errorCode=success | fillnull value="m1.small" requestParameters.instanceType + search: sourcetype=aws:cloudtrail eventName=RunInstances + [search sourcetype=aws:cloudtrail eventName=RunInstances errorCode=success + | fillnull value="m1.small" requestParameters.instanceType | stats earliest(_time) as earliest latest(_time) as latest by requestParameters.instanceType - | rename requestParameters.instanceType as instanceType | inputlookup append=t - previously_seen_ec2_instance_types.csv | stats min(earliest) as earliest max(latest) - as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv - | eval newType=if(earliest >= relative_time(now(), "-70m@m"), 1, 0) | convert - security_content_ctime(earliest) security_content_ctime(latest) | where newType=1 | rename instanceType as requestParameters.instanceType - | table requestParameters.instanceType] | spath output=user userIdentity.arn + | rename requestParameters.instanceType as instanceType + | inputlookup append=t previously_seen_ec2_instance_types.csv + | stats min(earliest) as earliest max(latest) as latest by instanceType + | outputlookup previously_seen_ec2_instance_types.csv + | eval newType=if(earliest >= relative_time(now(), "-70m@m"), 1, 0) + | `security_content_ctime(earliest)` + | `security_content_ctime(latest)` + | where newType=1 + | rename instanceType as requestParameters.instanceType + | table requestParameters.instanceType] + | spath output=user userIdentity.arn | rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest | table _time, user, dest, instanceType suppress: @@ -67,14 +73,14 @@ known_false_positives: It is possible that an admin will create a new system usi to create the system with the new instance type. maintainers: - company: Splunk - email: davidd@splunk.com - name: David Dorsey + email: jhernandez@splunk.com + name: Jose Hernandez mappings: cis20: - CIS 1 nist: - ID.AM -modification_date: '2018-03-12' +modification_date: '2020-02-07' name: EC2 Instance Started With Previously Unseen Instance Type original_authors: - company: Splunk @@ -84,4 +90,4 @@ references: [] security_domain: endpoint spec_version: 2 type: splunk -version: '1.0' +version: '2.0'