admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

CRL-1646 - changing from user to src_user

Browse Source
This commit is contained in:
Jason Brewer
2019-11-25 15:49:32 -08:00
parent 38be9ebb26
commit 604e2ecc11
2 changed files with 8 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/train_ec2_excessive_runinstances.yml
+2 -3
View File
@@ -8,9 +8,8 @@ baseline:
latest_time: -1d@d
search: >-
sourcetype=aws:cloudtrail eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
| bucket span=10m _time
| rename arn AS userName
| stats count as instances_launched by _time userName
| bucket span=10m _time
| stats count as instances_launched by _time src_user
| fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1
creation_date: '2019-11-14'
data_metadata:
detections/ec2_excessive_runinstances_mltk.yml
+6 -7
View File
@@ -20,12 +20,12 @@ detect:
macros:
- ec2_excessive_runinstances_mltk_input_filter
notable:
nes_fields: userName
nes_fields: src_user
rule_description: An abnormally high number of instances were launched by
a user within in a 10-minute window
rule_title: High Number of instances launched by $userName$
rule_title: High Number of instances launched by $src_user$
risk:
risk_object: userName
risk_object: src_user
risk_object_type:
- user
risk_score: 30
@@ -36,13 +36,12 @@ detect:
search: >-
sourcetype=aws:cloudtrail eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
| bucket span=10m _time
| rename arn AS userName
| stats count as instances_launched by _time userName
| stats count as instances_launched by _time src_user
| apply ec2_excessive_runinstances_v1
| rename "IsOutlier(instances_launched)" as isOutlier
| where isOutlier=1
suppress:
suppress_fields: userName
suppress_fields: src_user
suppress_period: 3600s
eli5: In this search, we query CloudTrail logs to look for events where an instance
is successfully launched by a particular user. Since we want to detect a high number
@@ -50,7 +49,7 @@ eli5: In this search, we query CloudTrail logs to look for events where an insta
windows. We then compare the total number of instances launched by a particular
user against the saved baseline data in the model ec2_excessive_runinstances_v1.
entities:
- userName
- src_user
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. The threshold value should be tuned to your environment.