diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 7f05f630eb..b7a125bd2e 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -1,27 +1,23 @@ name: Detect Spike in AWS Security Hub Alerts for EC2 Instance id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 -version: 2 -date: '2020-07-21' -description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals +version: 3 +date: '2021-01-26' +description: This search looks for a spike in number of of AWS security Hub alerts + for an EC2 instance in 4 hours intervals how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub - inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security + Hub inputs. The threshold_value should be tuned to your environment and schedule + these searches according to the bucket span interval. type: ESCU references: [] author: Bhavin Patel, Splunk -search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance -| rex field=findings{}.Resources{}.Id .*instance/(?.*) -| rename instance as dest -| bucket span=4h _time -| stats count AS alerts by _time dest -| eventstats avg(alerts) - as total_launched_avg, stdev(alerts) as total_launched_stdev -| eval - threshold_value = 4 -| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev - * threshold_value), 1, 0) -| search isOutlier=1 -| table _time dest alerts|`detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' +search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h + _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) + as vendor_account values(vendor_region) as vendor_region values(severity) as severity + by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev + | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev + * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types + vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' known_false_positives: None tags: analytics_story: @@ -33,3 +29,6 @@ tags: - DE.AE security_domain: network asset_type: AWS Instance + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json diff --git a/detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml similarity index 86% rename from detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml rename to detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index af0649ef3f..ee12d07776 100644 --- a/detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -1,7 +1,7 @@ name: Detect Spike in AWS Security Hub Alerts for User id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222 -version: 2 -date: '2020-07-21' +version: 3 +date: '2021-01-26' description: This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals. how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub @@ -9,7 +9,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late type: ESCU references: [] author: Bhavin Patel, Splunk -search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time +search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time | stats count AS alerts by _time user | eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev diff --git a/macros/aws_securityhub_firehose.yml b/macros/aws_securityhub_finding.yml similarity index 67% rename from macros/aws_securityhub_firehose.yml rename to macros/aws_securityhub_finding.yml index b362424495..2f19f0c2aa 100644 --- a/macros/aws_securityhub_firehose.yml +++ b/macros/aws_securityhub_finding.yml @@ -1,4 +1,4 @@ -definition: sourcetype="aws:securityhub:firehose" +definition: sourcetype="aws:securityhub:finding" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: aws_securityhub_firehose +name: aws_securityhub_finding diff --git a/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml b/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml new file mode 100644 index 0000000000..a9f8379c96 --- /dev/null +++ b/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml @@ -0,0 +1,12 @@ +name: Detect Spike in AWS Security Hub Alerts for EC2 Instance Unit Test +tests: +- name: Detect Spike in AWS Security Hub Alerts for EC2 Instance + file: cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security_hub_ec2_spike.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json + sourcetype: aws:securityhub:finding + source: aws_securityhub_finding