From 5e0de647001e014ead1670cab25b80dcf1d754c4 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Jan 2021 13:53:28 -0800 Subject: [PATCH 1/9] search update --- ...ws_security_hub_alerts_for_ec2_instance.yml | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 7f05f630eb..9e85618864 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -9,19 +9,15 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late type: ESCU references: [] author: Bhavin Patel, Splunk -search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance -| rex field=findings{}.Resources{}.Id .*instance/(?.*) -| rename instance as dest +search: '`aws_securityhub_firehose` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time -| stats count AS alerts by _time dest -| eventstats avg(alerts) - as total_launched_avg, stdev(alerts) as total_launched_stdev -| eval - threshold_value = 4 -| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev - * threshold_value), 1, 0) +| stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest +| eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev +| eval threshold_value = 3 +| eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 -| table _time dest alerts|`detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' +| table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg +| `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' known_false_positives: None tags: analytics_story: From f446cc2f8ac80422940fefb94a0ae0ba653bb3d7 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Jan 2021 13:54:49 -0800 Subject: [PATCH 2/9] test file --- ...aws_security_hub_alerts_for_ec2_instance.test.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml diff --git a/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml b/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml new file mode 100644 index 0000000000..a9f8379c96 --- /dev/null +++ b/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.test.yml @@ -0,0 +1,12 @@ +name: Detect Spike in AWS Security Hub Alerts for EC2 Instance Unit Test +tests: +- name: Detect Spike in AWS Security Hub Alerts for EC2 Instance + file: cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security_hub_ec2_spike.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json + sourcetype: aws:securityhub:finding + source: aws_securityhub_finding From b233d1a1fc453007c242531314747c5426c33488 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Jan 2021 14:07:19 -0800 Subject: [PATCH 3/9] minor --- ...r.yml => detect_spike_in_aws_security_hub_alerts_for_user.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/cloud/{detect_spike_in_security_hub_alerts_for_user.yml => detect_spike_in_aws_security_hub_alerts_for_user.yml} (100%) diff --git a/detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml similarity index 100% rename from detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml rename to detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml From 1b799d788c95581aeb6a0ac1bece4e8398856025 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Jan 2021 15:46:36 -0800 Subject: [PATCH 4/9] user test file draft --- ...pike_in_aws_security_hub_alerts_for_user.test.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml diff --git a/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml b/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml new file mode 100644 index 0000000000..dd0c2d1241 --- /dev/null +++ b/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml @@ -0,0 +1,12 @@ +name: Detect Spike in AWS Security Hub Alerts for User Unit Test +tests: +- name: Detect Spike in AWS Security Hub Alerts for User + file: cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: security_hub_ec2_spike.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json + sourcetype: aws:securityhub:finding + source: aws_securityhub_finding From 1d4e14ad93be1988ebb1de787b3a6eede4e650c6 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Jan 2021 18:51:06 -0800 Subject: [PATCH 5/9] macro fixes --- ...ct_spike_in_aws_security_hub_alerts_for_ec2_instance.yml | 6 +++--- .../detect_spike_in_aws_security_hub_alerts_for_user.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 9e85618864..489352502b 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -1,7 +1,7 @@ name: Detect Spike in AWS Security Hub Alerts for EC2 Instance id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 -version: 2 -date: '2020-07-21' +version: 3 +date: '2021-01-26' description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub @@ -9,7 +9,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late type: ESCU references: [] author: Bhavin Patel, Splunk -search: '`aws_securityhub_firehose` "Resources{}.Type"=AWSEC2Instance +search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index af0649ef3f..ee12d07776 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -1,7 +1,7 @@ name: Detect Spike in AWS Security Hub Alerts for User id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222 -version: 2 -date: '2020-07-21' +version: 3 +date: '2021-01-26' description: This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals. how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub @@ -9,7 +9,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late type: ESCU references: [] author: Bhavin Patel, Splunk -search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time +search: '`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time | stats count AS alerts by _time user | eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev From edeaa89c7d0cad95dc9bc85698b4724ffcb4222d Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Jan 2021 18:53:01 -0800 Subject: [PATCH 6/9] macros for all --- macros/aws_securityhub_firehose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/macros/aws_securityhub_firehose.yml b/macros/aws_securityhub_firehose.yml index b362424495..2f19f0c2aa 100644 --- a/macros/aws_securityhub_firehose.yml +++ b/macros/aws_securityhub_firehose.yml @@ -1,4 +1,4 @@ -definition: sourcetype="aws:securityhub:firehose" +definition: sourcetype="aws:securityhub:finding" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: aws_securityhub_firehose +name: aws_securityhub_finding From ec76d28b6026a2d3559bc498d07ce4839007478e Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 26 Jan 2021 19:28:03 -0800 Subject: [PATCH 7/9] rename --- .../{aws_securityhub_firehose.yml => aws_securityhub_finding.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename macros/{aws_securityhub_firehose.yml => aws_securityhub_finding.yml} (100%) diff --git a/macros/aws_securityhub_firehose.yml b/macros/aws_securityhub_finding.yml similarity index 100% rename from macros/aws_securityhub_firehose.yml rename to macros/aws_securityhub_finding.yml From 30bb53bfbcb44e83065441be6adf56b414c250cb Mon Sep 17 00:00:00 2001 From: root Date: Wed, 27 Jan 2021 03:30:48 +0000 Subject: [PATCH 8/9] Added detection testing service results inDetect Spike in AWS Security Hub Alerts for EC2 Instance --- ...s_security_hub_alerts_for_ec2_instance.yml | 27 ++++++++++--------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 489352502b..b7a125bd2e 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -2,22 +2,22 @@ name: Detect Spike in AWS Security Hub Alerts for EC2 Instance id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 version: 3 date: '2021-01-26' -description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals +description: This search looks for a spike in number of of AWS security Hub alerts + for an EC2 instance in 4 hours intervals how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub - inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security + Hub inputs. The threshold_value should be tuned to your environment and schedule + these searches according to the bucket span interval. type: ESCU references: [] author: Bhavin Patel, Splunk -search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance -| bucket span=4h _time -| stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest -| eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev -| eval threshold_value = 3 -| eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) -| search isOutlier=1 -| table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg -| `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' +search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h + _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) + as vendor_account values(vendor_region) as vendor_region values(severity) as severity + by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev + | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev + * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types + vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' known_false_positives: None tags: analytics_story: @@ -29,3 +29,6 @@ tags: - DE.AE security_domain: network asset_type: AWS Instance + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json From df2cd4195951a8d1765c45a16d59c6e77ddc8f66 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 3 Feb 2021 14:10:14 -0800 Subject: [PATCH 9/9] remove security hub for user test file since there is not data yet --- ...pike_in_aws_security_hub_alerts_for_user.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml diff --git a/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml b/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml deleted file mode 100644 index dd0c2d1241..0000000000 --- a/tests/cloud/detect_spike_in_aws_security_hub_alerts_for_user.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Detect Spike in AWS Security Hub Alerts for User Unit Test -tests: -- name: Detect Spike in AWS Security Hub Alerts for User - file: cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: security_hub_ec2_spike.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json - sourcetype: aws:securityhub:finding - source: aws_securityhub_finding