From 4bd7eae3c8c6cdcd7587a48dcd16d32dcd8760bc Mon Sep 17 00:00:00 2001 From: David Dorsey Date: Wed, 26 Aug 2020 23:17:03 -0500 Subject: [PATCH] Removed unused file --- ...stances_terminated_by_user___mltk___dm.yml | 33 ------------------- 1 file changed, 33 deletions(-) delete mode 100644 baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk___dm.yml diff --git a/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk___dm.yml b/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk___dm.yml deleted file mode 100644 index 7e789dc4dc..0000000000 --- a/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk___dm.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Baseline of Excessive AWS Instances Terminated by User - MLTK - DM -id: 8ab7a5ed-e8af-4fe3-bcdd-ac8c820eb51c -version: 1 -date: '2020-08-14' -XXXdescription: This search is used to build a Machine Learning Toolkit (MLTK) model - for how many TerminateInstances users do in the environment. By default, the search - uses the last 90 days of data to build the model. The model created by this search - is then used in the corresponding detection search, which identifies subsequent - outliers in the number of TerminateInstances performed by a user in a small time - window. -XXXhow_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs.\ - - In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, - along with any required dependencies. Depending on the number of users in your environment, - you may also need to adjust the value for max_inputs in the MLTK settings for the - DensityFunction algorithm, then ensure that the search completes in a reasonable - timeframe. By default, the search builds the model using the past 30 days of data. - You can modify the search window to build the model over a longer period of time, - which may give you better results. You may also want to periodically re-run this - search to rebuild the model with the latest data.\ - - More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.' -author: Rico Valdez, Splunk -search: '| tstats count from datamodel=Change where (All_Changes.action=stopped OR All_Changes.action=deleted) - All_Changes.status=success All_Changes.object_category=instance `ec2_excessive_terminateinstances_mltk_input_filter` by All_Changes.user _time span=10m - | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1' -tags: - analytics_story: - - Suspicious AWS EC2 Activities - detections: - - Abnormally High AWS Instances Terminated by User - MLTK - DM