admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed unused file

Browse Source
This commit is contained in:
David Dorsey
2020-08-26 23:17:03 -05:00
committed by jzsplunk
parent 181f810dbb
commit 4bd7eae3c8
1 changed files with 0 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk___dm.yml
-33
View File
@@ -1,33 +0,0 @@
name: Baseline of Excessive AWS Instances Terminated by User - MLTK - DM
id: 8ab7a5ed-e8af-4fe3-bcdd-ac8c820eb51c
version: 1
date: '2020-08-14'
XXXdescription: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many TerminateInstances users do in the environment. By default, the search
uses the last 90 days of data to build the model. The model created by this search
is then used in the corresponding detection search, which identifies subsequent
outliers in the number of TerminateInstances performed by a user in a small time
window.
XXXhow_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.\
In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed,
along with any required dependencies. Depending on the number of users in your environment,
you may also need to adjust the value for max_inputs in the MLTK settings for the
DensityFunction algorithm, then ensure that the search completes in a reasonable
timeframe. By default, the search builds the model using the past 30 days of data.
You can modify the search window to build the model over a longer period of time,
which may give you better results. You may also want to periodically re-run this
search to rebuild the model with the latest data.\
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
author: Rico Valdez, Splunk
search: '| tstats count from datamodel=Change where (All_Changes.action=stopped OR All_Changes.action=deleted)
All_Changes.status=success All_Changes.object_category=instance `ec2_excessive_terminateinstances_mltk_input_filter` by All_Changes.user _time span=10m
| fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
tags:
analytics_story:
- Suspicious AWS EC2 Activities
detections:
- Abnormally High AWS Instances Terminated by User - MLTK - DM