admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-02-04 16:36:11 +00:00
committed by GitHub
parent fea7aa641d 91931235d8
commit 774ce3dfe7
4 changed files with 34 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+17 -18
View File
@@ -1,27 +1,23 @@
name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
version: 2
date: '2020-07-21'
description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
version: 3
date: '2021-01-26'
description: This search looks for a spike in number of of AWS security Hub alerts
for an EC2 instance in 4 hours intervals
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub
inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
Hub inputs. The threshold_value should be tuned to your environment and schedule
these searches according to the bucket span interval.
type: ESCU
references: []
author: Bhavin Patel, Splunk
search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance
| rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)
| rename instance as dest
| bucket span=4h _time
| stats count AS alerts by _time dest
| eventstats avg(alerts)
as total_launched_avg, stdev(alerts) as total_launched_stdev
| eval
threshold_value = 4
| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev
* threshold_value), 1, 0)
| search isOutlier=1
| table _time dest alerts|`detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
_time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account)
as vendor_account values(vendor_region) as vendor_region values(severity) as severity
by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev
| eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev
* threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
known_false_positives: None
tags:
analytics_story:
@@ -33,3 +29,6 @@ tags:
- DE.AE
security_domain: network
asset_type: AWS Instance
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json
detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml → detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Detect Spike in AWS Security Hub Alerts for User
id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222
version: 2
date: '2020-07-21'
version: 3
date: '2021-01-26'
description: This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub
@@ -9,7 +9,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late
type: ESCU
references: []
author: Bhavin Patel, Splunk
search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time
search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time
| stats count AS alerts by _time user
| eventstats avg(alerts)
as total_launched_avg, stdev(alerts) as total_launched_stdev
macros/aws_securityhub_firehose.yml → macros/aws_securityhub_finding.yml
+2 -2
View File
@@ -1,4 +1,4 @@
definition: sourcetype="aws:securityhub:firehose"
definition: sourcetype="aws:securityhub:finding"
description: customer specific splunk configurations(eg- index, source, sourcetype).
Replace the macro definition with configurations for your Splunk Environmnent.
name: aws_securityhub_firehose
name: aws_securityhub_finding
tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml
+12
View File
@@ -0,0 +1,12 @@
name: Detect Spike in AWS Security Hub Alerts for EC2 Instance Unit Test
tests:
- name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
file: cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: security_hub_ec2_spike.json
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json
sourcetype: aws:securityhub:finding
source: aws_securityhub_finding