mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
CRL-1652 - Saving progress so far on MLTK part 2 stuff so it will not interfere.
This commit is contained in:
Jason Brewer
@@ -0,0 +1,47 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventType=AwsApiCall | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats
|
||||
count
|
||||
creation_date: '2018-04-09'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of API calls made by each user. Also recorded is the number
|
||||
of data points for each user. This table is then outputted to a lookup file to allow
|
||||
the detection search to operate quickly.
|
||||
eli5: This search returns all log events that are API calls, pulls out the ARN that
|
||||
initiated each call, and collects them in one-hour groupings. Next, it calculates
|
||||
the number of API calls made per ARN per hour. For each ARN, it calculates the average
|
||||
and standard deviation of this count on a per-hour basis. It also includes the
|
||||
number of data points each ARN had. This table is then stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs.
|
||||
id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
modification_date: '2018-04-09'
|
||||
name: Baseline of API Calls per User ARN - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,47 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventType=AwsApiCall | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats
|
||||
count
|
||||
creation_date: '2018-04-09'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of API calls made by each user. Also recorded is the number
|
||||
of data points for each user. This table is then outputted to a lookup file to allow
|
||||
the detection search to operate quickly.
|
||||
eli5: This search returns all log events that are API calls, pulls out the ARN that
|
||||
initiated each call, and collects them in one-hour groupings. Next, it calculates
|
||||
the number of API calls made per ARN per hour. For each ARN, it calculates the average
|
||||
and standard deviation of this count on a per-hour basis. It also includes the
|
||||
number of data points each ARN had. This table is then stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs.
|
||||
id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
modification_date: '2018-04-09'
|
||||
name: Baseline of API Calls per User ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,47 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventType=AwsApiCall | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats
|
||||
count
|
||||
creation_date: '2018-04-09'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of API calls made by each user. Also recorded is the number
|
||||
of data points for each user. This table is then outputted to a lookup file to allow
|
||||
the detection search to operate quickly.
|
||||
eli5: This search returns all log events that are API calls, pulls out the ARN that
|
||||
initiated each call, and collects them in one-hour groupings. Next, it calculates
|
||||
the number of API calls made per ARN per hour. For each ARN, it calculates the average
|
||||
and standard deviation of this count on a per-hour basis. It also includes the
|
||||
number of data points each ARN had. This table is then stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs.
|
||||
id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
modification_date: '2018-04-09'
|
||||
name: Baseline of API Calls per User ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,54 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -30d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8
|
||||
OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND
|
||||
dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h |
|
||||
stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections)
|
||||
as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections)
|
||||
as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections
|
||||
by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections,
|
||||
stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections
|
||||
| stats count
|
||||
creation_date: '2018-04-26'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS VPC Flow Logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudwatchlogs:vpcflow
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of outbound connections blocked in your VPC flow logs by
|
||||
each source IP address (IP address of your EC2 instances). Also recorded is the
|
||||
number of data points for each source IP. This table outputs to a lookup file to
|
||||
allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline of blocked outbound network connections
|
||||
by each source IP in your AWS environment. This search returns all log events that
|
||||
correspond to a blocked outbound network connection, extracts the source IP from
|
||||
where the outbound connection was initiated, and collects the events in one-hour
|
||||
groupings. Next, it calculates the number of outbound connections blocked per hour.
|
||||
For each source IP, it calculates the average and standard deviation of this count
|
||||
on a per-hour basis. It also includes the number of data points each source IP
|
||||
had. This table is then stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
|
||||
logs.`.
|
||||
id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-05-07'
|
||||
name: Baseline of blocked outbound traffic from AWS - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,54 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -30d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8
|
||||
OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND
|
||||
dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h |
|
||||
stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections)
|
||||
as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections)
|
||||
as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections
|
||||
by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections,
|
||||
stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections
|
||||
| stats count
|
||||
creation_date: '2018-04-26'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS VPC Flow Logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudwatchlogs:vpcflow
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of outbound connections blocked in your VPC flow logs by
|
||||
each source IP address (IP address of your EC2 instances). Also recorded is the
|
||||
number of data points for each source IP. This table outputs to a lookup file to
|
||||
allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline of blocked outbound network connections
|
||||
by each source IP in your AWS environment. This search returns all log events that
|
||||
correspond to a blocked outbound network connection, extracts the source IP from
|
||||
where the outbound connection was initiated, and collects the events in one-hour
|
||||
groupings. Next, it calculates the number of outbound connections blocked per hour.
|
||||
For each source IP, it calculates the average and standard deviation of this count
|
||||
on a per-hour basis. It also includes the number of data points each source IP
|
||||
had. This table is then stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
|
||||
logs.`.
|
||||
id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-05-07'
|
||||
name: Baseline of blocked outbound traffic from AWS
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,54 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -30d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8
|
||||
OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND
|
||||
dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h |
|
||||
stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections)
|
||||
as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections)
|
||||
as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections
|
||||
by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections,
|
||||
stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections
|
||||
| stats count
|
||||
creation_date: '2018-04-26'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS VPC Flow Logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudwatchlogs:vpcflow
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of outbound connections blocked in your VPC flow logs by
|
||||
each source IP address (IP address of your EC2 instances). Also recorded is the
|
||||
number of data points for each source IP. This table outputs to a lookup file to
|
||||
allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline of blocked outbound network connections
|
||||
by each source IP in your AWS environment. This search returns all log events that
|
||||
correspond to a blocked outbound network connection, extracts the source IP from
|
||||
where the outbound connection was initiated, and collects the events in one-hour
|
||||
groupings. Next, it calculates the number of outbound connections blocked per hour.
|
||||
For each source IP, it calculates the average and standard deviation of this count
|
||||
on a per-hour basis. It also includes the number of data points each source IP
|
||||
had. This table is then stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
|
||||
logs.`.
|
||||
id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-05-07'
|
||||
name: Baseline of blocked outbound traffic from AWS
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,49 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -30d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `network_acl_events` | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats
|
||||
count
|
||||
creation_date: '2018-05-21'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of API calls that were related to network ACLs made by each
|
||||
user. Also recorded is the number of data points for each user. This table is then
|
||||
outputted to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to network ACLs for
|
||||
the users who initiated this activity. It returns all logged API calls for network
|
||||
activity, pulls out the ARN that initiated each call, and collects the `eventNames`
|
||||
in one-hour groupings. Next, it calculates the number of API calls made per ARN
|
||||
per-hour. For each ARN, it calculates the average and standard deviation of this
|
||||
count on a per-hour basis. It also includes the number of data points for each ARN.
|
||||
This table is stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
|
||||
id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-05-21'
|
||||
name: Baseline of Network ACL Activity by ARN - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,49 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -30d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `network_acl_events` | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats
|
||||
count
|
||||
creation_date: '2018-05-21'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of API calls that were related to network ACLs made by each
|
||||
user. Also recorded is the number of data points for each user. This table is then
|
||||
outputted to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to network ACLs for
|
||||
the users who initiated this activity. It returns all logged API calls for network
|
||||
activity, pulls out the ARN that initiated each call, and collects the `eventNames`
|
||||
in one-hour groupings. Next, it calculates the number of API calls made per ARN
|
||||
per-hour. For each ARN, it calculates the average and standard deviation of this
|
||||
count on a per-hour basis. It also includes the number of data points for each ARN.
|
||||
This table is stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
|
||||
id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-05-21'
|
||||
name: Baseline of Network ACL Activity by ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,49 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -30d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `network_acl_events` | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats
|
||||
count
|
||||
creation_date: '2018-05-21'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation of the number of API calls that were related to network ACLs made by each
|
||||
user. Also recorded is the number of data points for each user. This table is then
|
||||
outputted to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to network ACLs for
|
||||
the users who initiated this activity. It returns all logged API calls for network
|
||||
activity, pulls out the ARN that initiated each call, and collects the `eventNames`
|
||||
in one-hour groupings. Next, it calculates the number of API calls made per ARN
|
||||
per-hour. For each ARN, it calculates the average and standard deviation of this
|
||||
count on a per-hour basis. It also includes the number of data points for each ARN.
|
||||
This table is stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
|
||||
id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-05-21'
|
||||
name: Baseline of Network ACL Activity by ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,48 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventName=DeleteBucket | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count
|
||||
creation_date: '2018-07-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and standard
|
||||
deviation for the number of API calls related to deleting an S3 bucket by each user.
|
||||
Also recorded is the number of data points for each user. This table is then outputted
|
||||
to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to deleting an S3
|
||||
bucket, grouped by the users who initiated this activity. It returns all logged
|
||||
API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated
|
||||
each call. Next, it calculates the number of API calls made per ARN per hour. For
|
||||
each ARN, it calculates the average and standard deviation of this count on a per-hour
|
||||
basis. It also includes the number of data points for each ARN. This table is stored
|
||||
in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs.
|
||||
id: 5c577fec-61f2-4d38-bae5-c605173fa671
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-07-17'
|
||||
name: Baseline of S3 Bucket deletion activity by ARN - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,48 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventName=DeleteBucket | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count
|
||||
creation_date: '2018-07-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and standard
|
||||
deviation for the number of API calls related to deleting an S3 bucket by each user.
|
||||
Also recorded is the number of data points for each user. This table is then outputted
|
||||
to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to deleting an S3
|
||||
bucket, grouped by the users who initiated this activity. It returns all logged
|
||||
API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated
|
||||
each call. Next, it calculates the number of API calls made per ARN per hour. For
|
||||
each ARN, it calculates the average and standard deviation of this count on a per-hour
|
||||
basis. It also includes the number of data points for each ARN. This table is stored
|
||||
in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs.
|
||||
id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-07-17'
|
||||
name: Baseline of S3 Bucket deletion activity by ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,48 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventName=DeleteBucket | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count
|
||||
creation_date: '2018-07-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and standard
|
||||
deviation for the number of API calls related to deleting an S3 bucket by each user.
|
||||
Also recorded is the number of data points for each user. This table is then outputted
|
||||
to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to deleting an S3
|
||||
bucket, grouped by the users who initiated this activity. It returns all logged
|
||||
API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated
|
||||
each call. Next, it calculates the number of API calls made per ARN per hour. For
|
||||
each ARN, it calculates the average and standard deviation of this count on a per-hour
|
||||
basis. It also includes the number of data points for each ARN. This table is stored
|
||||
in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs.
|
||||
id: 5c577fec-61f2-4d38-bae5-c605173fa671
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-07-17'
|
||||
name: Baseline of S3 Bucket deletion activity by ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,49 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `security_group_api_calls` | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline |
|
||||
stats count
|
||||
creation_date: '2018-04-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation for the number of API calls related to security groups made by each user.
|
||||
Also recorded is the number of data points for each user. This table is then outputted
|
||||
to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to security groups
|
||||
by the users who initiated this activity. It returns all logged API calls for all
|
||||
security-group-related activity, pulls out the ARN that initiated each call, and
|
||||
collects the `eventNames` in one-hour groupings. Next, it calculates the number
|
||||
of API calls made per ARN per hour. For each ARN, it calculates the average and
|
||||
standard deviation of this count on a per-hour basis. It also includes the number
|
||||
of data points for each ARN. This table is stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
|
||||
id: 765b3857-8d79-475f-8b21-2bea774cd641
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-04-17'
|
||||
name: Baseline of Security Group Activity by ARN - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,49 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `security_group_api_calls` | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline |
|
||||
stats count
|
||||
creation_date: '2018-04-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation for the number of API calls related to security groups made by each user.
|
||||
Also recorded is the number of data points for each user. This table is then outputted
|
||||
to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to security groups
|
||||
by the users who initiated this activity. It returns all logged API calls for all
|
||||
security-group-related activity, pulls out the ARN that initiated each call, and
|
||||
collects the `eventNames` in one-hour groupings. Next, it calculates the number
|
||||
of API calls made per ARN per hour. For each ARN, it calculates the average and
|
||||
standard deviation of this count on a per-hour basis. It also includes the number
|
||||
of data points for each ARN. This table is stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
|
||||
id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-04-17'
|
||||
name: Baseline of Security Group Activity by ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,49 @@
|
||||
baseline:
|
||||
splunk:
|
||||
schedule:
|
||||
cron_schedule: ''
|
||||
earliest_time: -90d@d
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `security_group_api_calls` | spath output=arn path=userIdentity.arn
|
||||
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
|
||||
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
|
||||
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
|
||||
avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline |
|
||||
stats count
|
||||
creation_date: '2018-04-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search establishes, on a per-hour basis, the average and the standard
|
||||
deviation for the number of API calls related to security groups made by each user.
|
||||
Also recorded is the number of data points for each user. This table is then outputted
|
||||
to a lookup file to allow the detection search to operate quickly.
|
||||
eli5: Use this search to create a baseline for API calls related to security groups
|
||||
by the users who initiated this activity. It returns all logged API calls for all
|
||||
security-group-related activity, pulls out the ARN that initiated each call, and
|
||||
collects the `eventNames` in one-hour groupings. Next, it calculates the number
|
||||
of API calls made per ARN per hour. For each ARN, it calculates the average and
|
||||
standard deviation of this count on a per-hour basis. It also includes the number
|
||||
of data points for each ARN. This table is stored in a lookup file.
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
|
||||
inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
|
||||
id: 765b3857-8d79-475f-8b21-2bea774cd641
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
modification_date: '2018-04-17'
|
||||
name: Baseline of Security Group Activity by ARN
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,151 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f
|
||||
name: Baseline of Network ACL Activity by ARN - MLTK
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-05-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes in API activity related
|
||||
to network access-control lists (ACLs)in your AWS environment.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls related to network
|
||||
ACLs by $user$ was detected.
|
||||
rule_title: Spike in AWS Network ACL activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 10 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `network_acl_events` [search sourcetype=aws:cloudtrail
|
||||
`network_acl_events` | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup network_acl_activity_baseline append=t |
|
||||
fields - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
network_acl_activity_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for creating/modifying/replacing network Access Control Lists (ACLs).\
|
||||
|
||||
1. Kick off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Count the number of API calls per Amazon Resource Name (ARN).\
|
||||
|
||||
1. Load the cache file that contains the number of data points, the count from the
|
||||
latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drop the count from the latest hour, since it is not necessary, and merge the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Rename `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculate the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. They do the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Update the cache file with the latest results.\
|
||||
|
||||
1. Set the minimum threshold for the number of data points and set the number of
|
||||
standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Make a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filter out anything that it determines is not a spike and return the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike. This search works best
|
||||
when you run the "Baseline of Network ACL Activity by ARN" support search once to
|
||||
create a lookup file of previously seen Network ACL Activity. To add or remove API
|
||||
event names related to network ACLs, edit the macro `network_acl_events`.
|
||||
id: c7bc51d2-330e-46da-a2e6-070909a602de
|
||||
investigations:
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
|
||||
name: AWS Network Interface details via resourceId
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
|
||||
name: AWS Network ACL Details from ID
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold`
|
||||
and `deviationThreshold`. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 12
|
||||
- CIS 11
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Persistence
|
||||
- Exfiltration
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-05-21'
|
||||
name: Detect Spike in Network ACL Activity - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,151 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
|
||||
name: Baseline of Network ACL Activity by ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-05-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes in API activity related
|
||||
to network access-control lists (ACLs)in your AWS environment.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls related to network
|
||||
ACLs by $user$ was detected.
|
||||
rule_title: Spike in AWS Network ACL activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 10 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `network_acl_events` [search sourcetype=aws:cloudtrail
|
||||
`network_acl_events` | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup network_acl_activity_baseline append=t |
|
||||
fields - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
network_acl_activity_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for creating/modifying/replacing network Access Control Lists (ACLs).\
|
||||
|
||||
1. Kick off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Count the number of API calls per Amazon Resource Name (ARN).\
|
||||
|
||||
1. Load the cache file that contains the number of data points, the count from the
|
||||
latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drop the count from the latest hour, since it is not necessary, and merge the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Rename `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculate the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. They do the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Update the cache file with the latest results.\
|
||||
|
||||
1. Set the minimum threshold for the number of data points and set the number of
|
||||
standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Make a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filter out anything that it determines is not a spike and return the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike. This search works best
|
||||
when you run the "Baseline of Network ACL Activity by ARN" support search once to
|
||||
create a lookup file of previously seen Network ACL Activity. To add or remove API
|
||||
event names related to network ACLs, edit the macro `network_acl_events`.
|
||||
id: ada0f478-84a8-4641-a1f1-e32372d4bd53
|
||||
investigations:
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
|
||||
name: AWS Network Interface details via resourceId
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
|
||||
name: AWS Network ACL Details from ID
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold`
|
||||
and `deviationThreshold`. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 12
|
||||
- CIS 11
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Persistence
|
||||
- Exfiltration
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-05-21'
|
||||
name: Detect Spike in Network ACL Activity
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,151 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: f4bc7f4b-9bce-44d8-82eb-ada06f6b493f
|
||||
name: Baseline of Network ACL Activity by ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-05-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes in API activity related
|
||||
to network access-control lists (ACLs)in your AWS environment.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls related to network
|
||||
ACLs by $user$ was detected.
|
||||
rule_title: Spike in AWS Network ACL activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 10 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `network_acl_events` [search sourcetype=aws:cloudtrail
|
||||
`network_acl_events` | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup network_acl_activity_baseline append=t |
|
||||
fields - latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
network_acl_activity_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for creating/modifying/replacing network Access Control Lists (ACLs).\
|
||||
|
||||
1. Kick off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Count the number of API calls per Amazon Resource Name (ARN).\
|
||||
|
||||
1. Load the cache file that contains the number of data points, the count from the
|
||||
latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drop the count from the latest hour, since it is not necessary, and merge the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Rename `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculate the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. They do the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Update the cache file with the latest results.\
|
||||
|
||||
1. Set the minimum threshold for the number of data points and set the number of
|
||||
standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Make a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filter out anything that it determines is not a spike and return the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike. This search works best
|
||||
when you run the "Baseline of Network ACL Activity by ARN" support search once to
|
||||
create a lookup file of previously seen Network ACL Activity. To add or remove API
|
||||
event names related to network ACLs, edit the macro `network_acl_events`.
|
||||
id: c7bc51d2-330e-46da-a2e6-070909a602de
|
||||
investigations:
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
|
||||
name: AWS Network Interface details via resourceId
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
|
||||
name: AWS Network ACL Details from ID
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold`
|
||||
and `deviationThreshold`. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 12
|
||||
- CIS 11
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Persistence
|
||||
- Exfiltration
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-05-21'
|
||||
name: Detect Spike in Network ACL Activity
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,155 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0
|
||||
name: Baseline of API Calls per User ARN - MLTK
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-03-12'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes of API activity in your
|
||||
AWS environment. It will also update the cache file that factors in the latest
|
||||
data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls by $user$ was detected.
|
||||
rule_title: Spike in AWS API activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventType=AwsApiCall [search sourcetype=aws:cloudtrail
|
||||
eventType=AwsApiCall | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup api_call_by_user_baseline append=t | fields
|
||||
- latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
api_call_by_user_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through a series of steps,
|
||||
as per the following: \
|
||||
|
||||
1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls.\
|
||||
|
||||
1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Counts the number of API calls per ARN.\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike.\
|
||||
|
||||
This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`)
|
||||
that are not yet supported by ES Incident Review and therefore cannot be viewed
|
||||
when a notable event is raised. These fields contribute additional context to the
|
||||
notable. To see the additional metadata, add the following fields, if not already
|
||||
present, to Incident Review - Event Attributes (Configure > Incident Management
|
||||
> Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:**
|
||||
eventName\
|
||||
|
||||
1. \
|
||||
|
||||
1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\
|
||||
|
||||
1. \
|
||||
|
||||
1. **Label:** Unique API Calls, **Field:** uniqueApisCalled\
|
||||
|
||||
Detailed documentation on how to create a new field within Incident Review may be
|
||||
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
|
||||
id: 06bf47d6-c47a-4a84-a491-d2857b542e67
|
||||
investigations:
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
|
||||
name: Investigate AWS User Activities by user field
|
||||
type: splunk
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 16
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-04-09'
|
||||
name: Detect Spike in AWS API Activity - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,155 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
|
||||
name: Baseline of API Calls per User ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-03-12'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes of API activity in your
|
||||
AWS environment. It will also update the cache file that factors in the latest
|
||||
data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls by $user$ was detected.
|
||||
rule_title: Spike in AWS API activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventType=AwsApiCall [search sourcetype=aws:cloudtrail
|
||||
eventType=AwsApiCall | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup api_call_by_user_baseline append=t | fields
|
||||
- latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
api_call_by_user_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through a series of steps,
|
||||
as per the following: \
|
||||
|
||||
1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls.\
|
||||
|
||||
1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Counts the number of API calls per ARN.\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike.\
|
||||
|
||||
This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`)
|
||||
that are not yet supported by ES Incident Review and therefore cannot be viewed
|
||||
when a notable event is raised. These fields contribute additional context to the
|
||||
notable. To see the additional metadata, add the following fields, if not already
|
||||
present, to Incident Review - Event Attributes (Configure > Incident Management
|
||||
> Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:**
|
||||
eventName\
|
||||
|
||||
1. \
|
||||
|
||||
1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\
|
||||
|
||||
1. \
|
||||
|
||||
1. **Label:** Unique API Calls, **Field:** uniqueApisCalled\
|
||||
|
||||
Detailed documentation on how to create a new field within Incident Review may be
|
||||
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
|
||||
id: ada0f478-84a8-4641-a3f1-d32362d4bd55
|
||||
investigations:
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
|
||||
name: Investigate AWS User Activities by user field
|
||||
type: splunk
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 16
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-04-09'
|
||||
name: Detect Spike in AWS API Activity
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,155 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: ee7dfb8b-fc3b-44d0-812e-0be53ee060d0
|
||||
name: Baseline of API Calls per User ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-03-12'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes of API activity in your
|
||||
AWS environment. It will also update the cache file that factors in the latest
|
||||
data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls by $user$ was detected.
|
||||
rule_title: Spike in AWS API activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventType=AwsApiCall [search sourcetype=aws:cloudtrail
|
||||
eventType=AwsApiCall | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup api_call_by_user_baseline append=t | fields
|
||||
- latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
api_call_by_user_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through a series of steps,
|
||||
as per the following: \
|
||||
|
||||
1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls.\
|
||||
|
||||
1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Counts the number of API calls per ARN.\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike.\
|
||||
|
||||
This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`)
|
||||
that are not yet supported by ES Incident Review and therefore cannot be viewed
|
||||
when a notable event is raised. These fields contribute additional context to the
|
||||
notable. To see the additional metadata, add the following fields, if not already
|
||||
present, to Incident Review - Event Attributes (Configure > Incident Management
|
||||
> Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:**
|
||||
eventName\
|
||||
|
||||
1. \
|
||||
|
||||
1. **Label:** Number of API Calls, **Field:** numberOfApiCalls\
|
||||
|
||||
1. \
|
||||
|
||||
1. **Label:** Unique API Calls, **Field:** uniqueApisCalled\
|
||||
|
||||
Detailed documentation on how to create a new field within Incident Review may be
|
||||
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
|
||||
id: 06bf47d6-c47a-4a84-a491-d2857b542e67
|
||||
investigations:
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
|
||||
name: Investigate AWS User Activities by user field
|
||||
type: splunk
|
||||
known_false_positives: ''
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 16
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-04-09'
|
||||
name: Detect Spike in AWS API Activity
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: davidd@splunk.com
|
||||
name: David Dorsey
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,142 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: 765b3857-8d79-475f-8b21-2bea774cd641
|
||||
name: Baseline of Security Group Activity by ARN - MLTK
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-04-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes in API activity related
|
||||
to security groups in your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls related to security
|
||||
groups by $user$ was detected.
|
||||
rule_title: Spike in AWS Security Group activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `security_group_api_calls` [search sourcetype=aws:cloudtrail
|
||||
`security_group_api_calls` | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup security_group_activity_baseline append=t
|
||||
| fields - latestCount | stats values(*) as * by arn | rename apiCalls as
|
||||
latestCount | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720
|
||||
| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720))
|
||||
| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
security_group_activity_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for security groups.\
|
||||
|
||||
1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Counts the number of API calls per ARN.\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike.This search works best
|
||||
when you run the "Baseline of Security Group Activity by ARN" support search once
|
||||
to create a history of previously seen Security Group Activity. To add or remove
|
||||
API event names for security groups, edit the macro `security_group_api_calls`.
|
||||
id: f0a6dda0-a5b2-4b30-977d-ac1b063b8820
|
||||
investigations:
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
|
||||
name: Investigate AWS User Activities by user field
|
||||
type: splunk
|
||||
known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`,
|
||||
the false positive rate may vary. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 16
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-04-18'
|
||||
name: Detect Spike in Security Group Activity - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,142 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
|
||||
name: Baseline of Security Group Activity by ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-04-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes in API activity related
|
||||
to security groups in your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls related to security
|
||||
groups by $user$ was detected.
|
||||
rule_title: Spike in AWS Security Group activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `security_group_api_calls` [search sourcetype=aws:cloudtrail
|
||||
`security_group_api_calls` | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup security_group_activity_baseline append=t
|
||||
| fields - latestCount | stats values(*) as * by arn | rename apiCalls as
|
||||
latestCount | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720
|
||||
| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720))
|
||||
| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
security_group_activity_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for security groups.\
|
||||
|
||||
1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Counts the number of API calls per ARN.\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike.This search works best
|
||||
when you run the "Baseline of Security Group Activity by ARN" support search once
|
||||
to create a history of previously seen Security Group Activity. To add or remove
|
||||
API event names for security groups, edit the macro `security_group_api_calls`.
|
||||
id: ada0f478-84a8-4641-a3f1-e32372d4bd53
|
||||
investigations:
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
|
||||
name: Investigate AWS User Activities by user field
|
||||
type: splunk
|
||||
known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`,
|
||||
the false positive rate may vary. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 16
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-04-18'
|
||||
name: Detect Spike in Security Group Activity
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,142 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: 765b3857-8d79-475f-8b21-2bea774cd641
|
||||
name: Baseline of Security Group Activity by ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-04-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect users creating spikes in API activity related
|
||||
to security groups in your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of AWS API calls related to security
|
||||
groups by $user$ was detected.
|
||||
rule_title: Spike in AWS Security Group activity detected by $user$
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail `security_group_api_calls` [search sourcetype=aws:cloudtrail
|
||||
`security_group_api_calls` | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup security_group_activity_baseline append=t
|
||||
| fields - latestCount | stats values(*) as * by arn | rename apiCalls as
|
||||
latestCount | eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720
|
||||
| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720))
|
||||
| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
security_group_activity_baseline | eval dataPointThreshold = 15, deviationThreshold
|
||||
= 3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName)
|
||||
as uniqueApisCalled by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieves all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for security groups.\
|
||||
|
||||
1. Kicks off a subsearch that retrieves the same data and pulls out the ARN into
|
||||
a more friendly format.\
|
||||
|
||||
1. Counts the number of API calls per ARN.\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each ARN with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation--weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of all the
|
||||
API calls, the number of unique API calls, and the total number of API calls for
|
||||
each of these ARNs. Finally, it looks up the average and standard deviation and
|
||||
returns both the average and the number of standard deviations the spike is from
|
||||
the average.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike.This search works best
|
||||
when you run the "Baseline of Security Group Activity by ARN" support search once
|
||||
to create a history of previously seen Security Group Activity. To add or remove
|
||||
API event names for security groups, edit the macro `security_group_api_calls`.
|
||||
id: f0a6dda0-a5b2-4b30-977d-ac1b063b8820
|
||||
investigations:
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76
|
||||
name: Investigate AWS User Activities by user field
|
||||
type: splunk
|
||||
known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`,
|
||||
the false positive rate may vary. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 16
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-04-18'
|
||||
name: Detect Spike in Security Group Activity
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,152 @@
|
||||
asset_type: S3 Bucket
|
||||
baselines:
|
||||
- id: 5c577fec-61f2-4d38-bae5-c605173fa671
|
||||
name: Baseline of S3 Bucket deletion activity by ARN - MLTK
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-07-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search detects users creating spikes in API activity related to
|
||||
deletion of S3 buckets in your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of S3 buckets deleted by $user$ was
|
||||
detected.
|
||||
rule_title: Spike detected in S3 bucket deletion activity by $user$.
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventName=DeleteBucket [search sourcetype=aws:cloudtrail
|
||||
eventName=DeleteBucket | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup s3_deletion_baseline append=t | fields -
|
||||
latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
s3_deletion_baseline | eval dataPointThreshold = 15, deviationThreshold =
|
||||
3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| spath output=bucketName path=requestParameters.bucketName | stats values(bucketName)
|
||||
as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled
|
||||
by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for deletion of S3 buckets.\
|
||||
|
||||
1. Kick off a subsearch that retrieves the same data and pulls out and converts
|
||||
the ARN into a more friendly format.\
|
||||
|
||||
1. Count the number of API calls per ARN.\
|
||||
|
||||
1. Load the cache file that contains the number of data points, the count from the
|
||||
latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drop the count from the latest hour, since it is unnecessary, and merge the rest
|
||||
of the data with the results of the `stats` command. \
|
||||
|
||||
1. Rename `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculate the new average value for each ARN with the latest count, weighting
|
||||
the past more heavily than the current hour. It does the same for the standard deviation—weighting
|
||||
the past more heavily than the current.\
|
||||
|
||||
1. Update the cache file with the latest results.\
|
||||
|
||||
1. Set the minimum threshold for the number of data points and the number of standard
|
||||
deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Make a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and if the count
|
||||
is a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filter out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of the deleted
|
||||
S3 buckets, the number of unique API calls, and the total number of API calls for
|
||||
each of these user ARNs.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike. This search works best
|
||||
when you run the "Baseline of S3 Bucket deletion activity by ARN" support search
|
||||
once to create a baseline of previously seen S3 bucket-deletion activity.
|
||||
id: a26fc0cf-2199-4fab-928d-4b13442ee871
|
||||
investigations:
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242
|
||||
name: AWS S3 Bucket details via bucketName
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: 446ec87a-85c6-40d4-b060-bea4498281d6
|
||||
name: Get All AWS Activity From IP Address
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
|
||||
name: Investigate AWS activities via region name
|
||||
type: splunk
|
||||
known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`,
|
||||
the false positive rate may vary. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 13
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-11-27'
|
||||
name: Detect Spike in S3 Bucket deletion - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,152 @@
|
||||
asset_type: S3 Bucket
|
||||
baselines:
|
||||
- id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
|
||||
name: Baseline of S3 Bucket deletion activity by ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-07-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search detects users creating spikes in API activity related to
|
||||
deletion of S3 buckets in your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of S3 buckets deleted by $user$ was
|
||||
detected.
|
||||
rule_title: Spike detected in S3 bucket deletion activity by $user$.
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventName=DeleteBucket [search sourcetype=aws:cloudtrail
|
||||
eventName=DeleteBucket | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup s3_deletion_baseline append=t | fields -
|
||||
latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
s3_deletion_baseline | eval dataPointThreshold = 15, deviationThreshold =
|
||||
3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| spath output=bucketName path=requestParameters.bucketName | stats values(bucketName)
|
||||
as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled
|
||||
by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for deletion of S3 buckets.\
|
||||
|
||||
1. Kick off a subsearch that retrieves the same data and pulls out and converts
|
||||
the ARN into a more friendly format.\
|
||||
|
||||
1. Count the number of API calls per ARN.\
|
||||
|
||||
1. Load the cache file that contains the number of data points, the count from the
|
||||
latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drop the count from the latest hour, since it is unnecessary, and merge the rest
|
||||
of the data with the results of the `stats` command. \
|
||||
|
||||
1. Rename `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculate the new average value for each ARN with the latest count, weighting
|
||||
the past more heavily than the current hour. It does the same for the standard deviation—weighting
|
||||
the past more heavily than the current.\
|
||||
|
||||
1. Update the cache file with the latest results.\
|
||||
|
||||
1. Set the minimum threshold for the number of data points and the number of standard
|
||||
deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Make a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and if the count
|
||||
is a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filter out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of the deleted
|
||||
S3 buckets, the number of unique API calls, and the total number of API calls for
|
||||
each of these user ARNs.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike. This search works best
|
||||
when you run the "Baseline of S3 Bucket deletion activity by ARN" support search
|
||||
once to create a baseline of previously seen S3 bucket-deletion activity.
|
||||
id: ad12w478-84a8-4641-a3w1-e32372q4bd53
|
||||
investigations:
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242
|
||||
name: AWS S3 Bucket details via bucketName
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: 446ec87a-85c6-40d4-b060-bea4498281d6
|
||||
name: Get All AWS Activity From IP Address
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
|
||||
name: Investigate AWS activities via region name
|
||||
type: splunk
|
||||
known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`,
|
||||
the false positive rate may vary. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 13
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-11-27'
|
||||
name: Detect Spike in S3 Bucket deletion
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,152 @@
|
||||
asset_type: S3 Bucket
|
||||
baselines:
|
||||
- id: 5c577fec-61f2-4d38-bae5-c605173fa671
|
||||
name: Baseline of S3 Bucket deletion activity by ARN
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-07-17'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS CloudTrail logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudtrail
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search detects users creating spikes in API activity related to
|
||||
deletion of S3 buckets in your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: user
|
||||
rule_description: A spike in the number of S3 buckets deleted by $user$ was
|
||||
detected.
|
||||
rule_title: Spike detected in S3 bucket deletion activity by $user$.
|
||||
risk:
|
||||
risk_object: user
|
||||
risk_object_type:
|
||||
- user
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudtrail eventName=DeleteBucket [search sourcetype=aws:cloudtrail
|
||||
eventName=DeleteBucket | spath output=arn path=userIdentity.arn | stats count
|
||||
as apiCalls by arn | inputlookup s3_deletion_baseline append=t | fields -
|
||||
latestCount | stats values(*) as * by arn | rename apiCalls as latestCount
|
||||
| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 | eval newStdevApiCalls=sqrt(((pow(stdevApiCalls,
|
||||
2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) | eval
|
||||
avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls,
|
||||
stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1)
|
||||
| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup
|
||||
s3_deletion_baseline | eval dataPointThreshold = 15, deviationThreshold =
|
||||
3 | eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | rename arn
|
||||
as userIdentity.arn | table userIdentity.arn] | spath output=user userIdentity.arn
|
||||
| spath output=bucketName path=requestParameters.bucketName | stats values(bucketName)
|
||||
as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled
|
||||
by user
|
||||
suppress:
|
||||
suppress_fields: user
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search and its corresponding subsearch run through the following series
|
||||
of steps: \
|
||||
|
||||
1. Retrieve all the AWS CloudTrail log entries that have recorded AWS API calls
|
||||
specifically for deletion of S3 buckets.\
|
||||
|
||||
1. Kick off a subsearch that retrieves the same data and pulls out and converts
|
||||
the ARN into a more friendly format.\
|
||||
|
||||
1. Count the number of API calls per ARN.\
|
||||
|
||||
1. Load the cache file that contains the number of data points, the count from the
|
||||
latest hour, the API call average, and the standard deviation for each ARN.\
|
||||
|
||||
1. Drop the count from the latest hour, since it is unnecessary, and merge the rest
|
||||
of the data with the results of the `stats` command. \
|
||||
|
||||
1. Rename `apiCalls` as `latestCount`.\
|
||||
|
||||
1. Calculate the new average value for each ARN with the latest count, weighting
|
||||
the past more heavily than the current hour. It does the same for the standard deviation—weighting
|
||||
the past more heavily than the current.\
|
||||
|
||||
1. Update the cache file with the latest results.\
|
||||
|
||||
1. Set the minimum threshold for the number of data points and the number of standard
|
||||
deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Make a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and if the count
|
||||
is a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filter out anything that it determines is not a spike and returns the list of
|
||||
ARNs to the main search. The main search subsequently gets the names of the deleted
|
||||
S3 buckets, the number of unique API calls, and the total number of API calls for
|
||||
each of these user ARNs.'
|
||||
entities:
|
||||
- user
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
||||
inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the minimum number of data
|
||||
points required to have a statistically significant amount of data to determine.
|
||||
The `deviationThreshold` variable is the number of standard deviations away from
|
||||
the mean that the value must be to be considered a spike. This search works best
|
||||
when you run the "Baseline of S3 Bucket deletion activity by ARN" support search
|
||||
once to create a baseline of previously seen S3 bucket-deletion activity.
|
||||
id: a26fc0cf-2199-4fab-928d-4b13442ee871
|
||||
investigations:
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242
|
||||
name: AWS S3 Bucket details via bucketName
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: 446ec87a-85c6-40d4-b060-bea4498281d6
|
||||
name: Get All AWS Activity From IP Address
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
|
||||
name: Investigate AWS activities via region name
|
||||
type: splunk
|
||||
known_false_positives: Based on the values of`dataPointThreshold` and `deviationThreshold`,
|
||||
the false positive rate may vary. Please modify this according the your environment.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 13
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack:
|
||||
- Credential Access
|
||||
- Execution
|
||||
nist:
|
||||
- DE.DP
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-11-27'
|
||||
name: Detect Spike in S3 Bucket deletion
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,183 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89
|
||||
name: Baseline of blocked outbound traffic from AWS - MLTK
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-04-26'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS VPC Flow Logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudwatchlogs:vpcflow
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect spike in blocked outbound network connections
|
||||
originating from within your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: src_ip
|
||||
rule_description: A spike in the blocked outbound connection is detected from
|
||||
source $src_ip$.
|
||||
rule_title: Spike in blocked outbound network connections from $src_ip$ detected.
|
||||
risk:
|
||||
risk_object: src_ip
|
||||
risk_object_type:
|
||||
- system
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8
|
||||
OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND
|
||||
dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search sourcetype=aws:cloudwatchlogs:vpcflow
|
||||
action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16)
|
||||
( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) |
|
||||
stats count as numberOfBlockedConnections by src_ip | inputlookup baseline_blocked_outbound_connections
|
||||
append=t | fields - latestCount | stats values(*) as * by src_ip | rename
|
||||
numberOfBlockedConnections as latestCount | eval newAvgBlockedConnections=avgBlockedConnections
|
||||
+ (latestCount-avgBlockedConnections)/720 | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections,
|
||||
2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720))
|
||||
| eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections),
|
||||
stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections),
|
||||
numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table
|
||||
src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections
|
||||
| outputlookup baseline_blocked_outbound_connections | eval dataPointThreshold
|
||||
= 5, deviationThreshold = 3 | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | table src_ip]
|
||||
| stats values(dest_ip) as "Blocked Destination IPs", values(interface_id)
|
||||
as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections
|
||||
by src_ip
|
||||
suppress:
|
||||
suppress_fields: src_ip
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search retrieves all the VPC Flow log entries that have recorded a blocked
|
||||
outbound network connection originating from your AWS environment. Then it kicks
|
||||
off a subsearch, which looks at the same data and performs the following series
|
||||
of steps: \
|
||||
|
||||
1. Counts the number of blocked outbound connections by each source IP\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the average blocked connections, and the standard deviation for
|
||||
each source IP.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `numberOfBlockedConnections` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each source IP with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation, weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
source IPs to the main search. The main search subsequently gets the list of all
|
||||
destination IPs for which the traffic was blocked, the network interface ID, the
|
||||
number of unique destination IP, and the total number of blocked connections for
|
||||
each of these source IP addresses. Finally, it looks up the average and standard
|
||||
deviation and returns both the average and the number of standard deviations the
|
||||
spike is from the average.'
|
||||
entities:
|
||||
- src_ip
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow
|
||||
logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the number of data points
|
||||
required to meet the definition of "spike." The `deviationThreshold` variable is
|
||||
the number of standard deviations away from the mean that the value must be to be
|
||||
considered a spike. This search works best when you run the "Baseline of Blocked
|
||||
Outbound Connection" support search once to create a history of previously seen
|
||||
blocked outbound connections.
|
||||
id: b1370336-450a-49e5-8c94-788136734a33
|
||||
investigations:
|
||||
- id: 910e6512-edc9-4f93-ba24-5b786f47a672
|
||||
name: Get Process Responsible For The DNS Traffic
|
||||
type: splunk
|
||||
- id: 9925d08f-561e-4faa-8912-e3888a842341
|
||||
name: Get Process Information For Port Activity
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
|
||||
name: Get Authentication Logs For Endpoint
|
||||
type: splunk
|
||||
- id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
|
||||
name: AWS Network Interface details via resourceId
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
|
||||
name: AWS Network ACL Details from ID
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72
|
||||
name: Get DNS Server History for a host
|
||||
type: splunk
|
||||
- id: fdcfb369-1725-4c24-824a-22972d7f0d55
|
||||
name: Get Risk Modifiers For User
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
|
||||
name: Get Process Info
|
||||
type: splunk
|
||||
- id: 446ec87a-85c6-40d4-b060-bea4498281d6
|
||||
name: Get All AWS Activity From IP Address
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73
|
||||
name: Get DNS traffic ratio
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: fdcfb369-1725-4c24-824a-22972d7f0d65
|
||||
name: Get Risk Modifiers For Endpoint
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold`
|
||||
and `deviationThreshold`. Additionally, false positives may result when AWS administrators
|
||||
roll out policies enforcing network blocks, causing sudden increases in the number
|
||||
of blocked outbound connections.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 11
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
- Command and Control
|
||||
mitre_attack:
|
||||
- Exfiltration
|
||||
- Command and Control
|
||||
nist:
|
||||
- DE.AE
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-05-07'
|
||||
name: Detect Spike in blocked Outbound Traffic from your AWS - MLTK
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,183 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
|
||||
name: Baseline of blocked outbound traffic from AWS
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-04-26'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS VPC Flow Logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudwatchlogs:vpcflow
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect spike in blocked outbound network connections
|
||||
originating from within your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: src_ip
|
||||
rule_description: A spike in the blocked outbound connection is detected from
|
||||
source $src_ip$.
|
||||
rule_title: Spike in blocked outbound network connections from $src_ip$ detected.
|
||||
risk:
|
||||
risk_object: src_ip
|
||||
risk_object_type:
|
||||
- system
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8
|
||||
OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND
|
||||
dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search sourcetype=aws:cloudwatchlogs:vpcflow
|
||||
action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16)
|
||||
( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) |
|
||||
stats count as numberOfBlockedConnections by src_ip | inputlookup baseline_blocked_outbound_connections
|
||||
append=t | fields - latestCount | stats values(*) as * by src_ip | rename
|
||||
numberOfBlockedConnections as latestCount | eval newAvgBlockedConnections=avgBlockedConnections
|
||||
+ (latestCount-avgBlockedConnections)/720 | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections,
|
||||
2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720))
|
||||
| eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections),
|
||||
stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections),
|
||||
numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table
|
||||
src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections
|
||||
| outputlookup baseline_blocked_outbound_connections | eval dataPointThreshold
|
||||
= 5, deviationThreshold = 3 | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | table src_ip]
|
||||
| stats values(dest_ip) as "Blocked Destination IPs", values(interface_id)
|
||||
as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections
|
||||
by src_ip
|
||||
suppress:
|
||||
suppress_fields: src_ip
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search retrieves all the VPC Flow log entries that have recorded a blocked
|
||||
outbound network connection originating from your AWS environment. Then it kicks
|
||||
off a subsearch, which looks at the same data and performs the following series
|
||||
of steps: \
|
||||
|
||||
1. Counts the number of blocked outbound connections by each source IP\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the average blocked connections, and the standard deviation for
|
||||
each source IP.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `numberOfBlockedConnections` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each source IP with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation, weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
source IPs to the main search. The main search subsequently gets the list of all
|
||||
destination IPs for which the traffic was blocked, the network interface ID, the
|
||||
number of unique destination IP, and the total number of blocked connections for
|
||||
each of these source IP addresses. Finally, it looks up the average and standard
|
||||
deviation and returns both the average and the number of standard deviations the
|
||||
spike is from the average.'
|
||||
entities:
|
||||
- src_ip
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow
|
||||
logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the number of data points
|
||||
required to meet the definition of "spike." The `deviationThreshold` variable is
|
||||
the number of standard deviations away from the mean that the value must be to be
|
||||
considered a spike. This search works best when you run the "Baseline of Blocked
|
||||
Outbound Connection" support search once to create a history of previously seen
|
||||
blocked outbound connections.
|
||||
id: ada0f278-84a8-46w1-a3f1-w32372d4bd53
|
||||
investigations:
|
||||
- id: 910e6512-edc9-4f93-ba24-5b786f47a672
|
||||
name: Get Process Responsible For The DNS Traffic
|
||||
type: splunk
|
||||
- id: 9925d08f-561e-4faa-8912-e3888a842341
|
||||
name: Get Process Information For Port Activity
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
|
||||
name: Get Authentication Logs For Endpoint
|
||||
type: splunk
|
||||
- id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
|
||||
name: AWS Network Interface details via resourceId
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
|
||||
name: AWS Network ACL Details from ID
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72
|
||||
name: Get DNS Server History for a host
|
||||
type: splunk
|
||||
- id: fdcfb369-1725-4c24-824a-22972d7f0d55
|
||||
name: Get Risk Modifiers For User
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
|
||||
name: Get Process Info
|
||||
type: splunk
|
||||
- id: 446ec87a-85c6-40d4-b060-bea4498281d6
|
||||
name: Get All AWS Activity From IP Address
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73
|
||||
name: Get DNS traffic ratio
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: fdcfb369-1725-4c24-824a-22972d7f0d65
|
||||
name: Get Risk Modifiers For Endpoint
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold`
|
||||
and `deviationThreshold`. Additionally, false positives may result when AWS administrators
|
||||
roll out policies enforcing network blocks, causing sudden increases in the number
|
||||
of blocked outbound connections.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 11
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
- Command and Control
|
||||
mitre_attack:
|
||||
- Exfiltration
|
||||
- Command and Control
|
||||
nist:
|
||||
- DE.AE
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-05-07'
|
||||
name: Detect Spike in blocked Outbound Traffic from your AWS
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,183 @@
|
||||
asset_type: AWS Instance
|
||||
baselines:
|
||||
- id: 8141a8f9-540f-45c7-8d6d-c5ac502afa89
|
||||
name: Baseline of blocked outbound traffic from AWS
|
||||
type: splunk
|
||||
confidence: medium
|
||||
creation_date: '2018-04-26'
|
||||
data_metadata:
|
||||
data_source:
|
||||
- AWS VPC Flow Logs
|
||||
data_sourcetypes:
|
||||
- aws:cloudwatchlogs:vpcflow
|
||||
providing_technologies:
|
||||
- AWS
|
||||
description: This search will detect spike in blocked outbound network connections
|
||||
originating from within your AWS environment. It will also update the cache file
|
||||
that factors in the latest data.
|
||||
detect:
|
||||
splunk:
|
||||
correlation_rule:
|
||||
notable:
|
||||
nes_fields: src_ip
|
||||
rule_description: A spike in the blocked outbound connection is detected from
|
||||
source $src_ip$.
|
||||
rule_title: Spike in blocked outbound network connections from $src_ip$ detected.
|
||||
risk:
|
||||
risk_object: src_ip
|
||||
risk_object_type:
|
||||
- system
|
||||
risk_score: 30
|
||||
schedule:
|
||||
cron_schedule: 0 * * * *
|
||||
earliest_time: -70m@m
|
||||
latest_time: -10m@m
|
||||
search: sourcetype=aws:cloudwatchlogs:vpcflow action=blocked (src_ip=10.0.0.0/8
|
||||
OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND
|
||||
dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search sourcetype=aws:cloudwatchlogs:vpcflow
|
||||
action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16)
|
||||
( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) |
|
||||
stats count as numberOfBlockedConnections by src_ip | inputlookup baseline_blocked_outbound_connections
|
||||
append=t | fields - latestCount | stats values(*) as * by src_ip | rename
|
||||
numberOfBlockedConnections as latestCount | eval newAvgBlockedConnections=avgBlockedConnections
|
||||
+ (latestCount-avgBlockedConnections)/720 | eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections,
|
||||
2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720))
|
||||
| eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections),
|
||||
stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections),
|
||||
numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) | table
|
||||
src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections
|
||||
| outputlookup baseline_blocked_outbound_connections | eval dataPointThreshold
|
||||
= 5, deviationThreshold = 3 | eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections)
|
||||
AND numDataPoints > dataPointThreshold, 1, 0) | where isSpike=1 | table src_ip]
|
||||
| stats values(dest_ip) as "Blocked Destination IPs", values(interface_id)
|
||||
as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections
|
||||
by src_ip
|
||||
suppress:
|
||||
suppress_fields: src_ip
|
||||
suppress_period: 14400s
|
||||
eli5: 'This search retrieves all the VPC Flow log entries that have recorded a blocked
|
||||
outbound network connection originating from your AWS environment. Then it kicks
|
||||
off a subsearch, which looks at the same data and performs the following series
|
||||
of steps: \
|
||||
|
||||
1. Counts the number of blocked outbound connections by each source IP\
|
||||
|
||||
1. Loads the cache file that contains the number of data points, the count from
|
||||
the latest hour, the average blocked connections, and the standard deviation for
|
||||
each source IP.\
|
||||
|
||||
1. Drops the count from the latest hour, since it is not necessary, and merges the
|
||||
rest of the data with the results of the stats command. \
|
||||
|
||||
1. Renames `numberOfBlockedConnections` as `latestCount`.\
|
||||
|
||||
1. Calculates the new average value for each source IP with the latest count, weighting
|
||||
the past much more heavily than the current hour. It does the same for the standard
|
||||
deviation, weighting the past more heavily than the current.\
|
||||
|
||||
1. Updates the cache file with the latest results.\
|
||||
|
||||
1. Sets the minimum threshold for the number of data points and sets the number
|
||||
of standard deviations away from the mean it must be to be considered a spike.\
|
||||
|
||||
1. Makes a determination regarding whether or not the current count is a spike by
|
||||
checking to see if the minimum data-point threshold has been met and the count is
|
||||
a sufficient number of standard deviations away from the average.\
|
||||
|
||||
1. Filters out anything that it determines is not a spike and returns the list of
|
||||
source IPs to the main search. The main search subsequently gets the list of all
|
||||
destination IPs for which the traffic was blocked, the network interface ID, the
|
||||
number of unique destination IP, and the total number of blocked connections for
|
||||
each of these source IP addresses. Finally, it looks up the average and standard
|
||||
deviation and returns both the average and the number of standard deviations the
|
||||
spike is from the average.'
|
||||
entities:
|
||||
- src_ip
|
||||
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
||||
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow
|
||||
logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit
|
||||
your environment. The `dataPointThreshold` variable is the number of data points
|
||||
required to meet the definition of "spike." The `deviationThreshold` variable is
|
||||
the number of standard deviations away from the mean that the value must be to be
|
||||
considered a spike. This search works best when you run the "Baseline of Blocked
|
||||
Outbound Connection" support search once to create a history of previously seen
|
||||
blocked outbound connections.
|
||||
id: b1370336-450a-49e5-8c94-788136734a33
|
||||
investigations:
|
||||
- id: 910e6512-edc9-4f93-ba24-5b786f47a672
|
||||
name: Get Process Responsible For The DNS Traffic
|
||||
type: splunk
|
||||
- id: 9925d08f-561e-4faa-8912-e3888a842341
|
||||
name: Get Process Information For Port Activity
|
||||
type: splunk
|
||||
- id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
|
||||
name: AWS Investigate User Activities By ARN
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
|
||||
name: Get Authentication Logs For Endpoint
|
||||
type: splunk
|
||||
- id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241
|
||||
name: AWS Network Interface details via resourceId
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242
|
||||
name: AWS Network ACL Details from ID
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72
|
||||
name: Get DNS Server History for a host
|
||||
type: splunk
|
||||
- id: fdcfb369-1725-4c24-824a-22972d7f0d55
|
||||
name: Get Risk Modifiers For User
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
|
||||
name: Get Process Info
|
||||
type: splunk
|
||||
- id: 446ec87a-85c6-40d4-b060-bea4498281d6
|
||||
name: Get All AWS Activity From IP Address
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73
|
||||
name: Get DNS traffic ratio
|
||||
type: splunk
|
||||
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
||||
name: Get Notable History
|
||||
type: splunk
|
||||
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
||||
name: Get Notable Info
|
||||
type: splunk
|
||||
- id: fdcfb369-1725-4c24-824a-22972d7f0d65
|
||||
name: Get Risk Modifiers For Endpoint
|
||||
type: splunk
|
||||
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd74
|
||||
name: Get User Information from Identity Table
|
||||
type: splunk
|
||||
known_false_positives: The false-positive rate may vary based on the values of`dataPointThreshold`
|
||||
and `deviationThreshold`. Additionally, false positives may result when AWS administrators
|
||||
roll out policies enforcing network blocks, causing sudden increases in the number
|
||||
of blocked outbound connections.
|
||||
maintainers:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
mappings:
|
||||
cis20:
|
||||
- CIS 11
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
- Command and Control
|
||||
mitre_attack:
|
||||
- Exfiltration
|
||||
- Command and Control
|
||||
nist:
|
||||
- DE.AE
|
||||
- DE.CM
|
||||
- PR.AC
|
||||
modification_date: '2018-05-07'
|
||||
name: Detect Spike in blocked Outbound Traffic from your AWS
|
||||
original_authors:
|
||||
- company: Splunk
|
||||
email: bpatel@splunk.com
|
||||
name: Bhavin Patel
|
||||
references: []
|
||||
security_domain: network
|
||||
spec_version: 2
|
||||
type: splunk
|
||||
version: '1.0'
|
||||
@@ -0,0 +1,20 @@
|
||||
s/fc0edc96-ff2b-48b0-9f6f-63da3783fd63/ee7dfb8b-fc3b-44d0-812e-0be53ee060d0/g
|
||||
s/fc0edd96-ff2b-48b0-9f1f-63da3782fd63/8141a8f9-540f-45c7-8d6d-c5ac502afa89/g
|
||||
s/fc0edd96-ff2b-4810-9f1f-63da3783fd63/f4bc7f4b-9bce-44d8-82eb-ada06f6b493f/g
|
||||
s/fc0edd96-ff2b-48b0-9f1f-63eq3783fd63/5c577fec-61f2-4d38-bae5-c605173fa671/g
|
||||
s/fc0edd96-ff2b-48b0-9f1f-63da3783fd63/765b3857-8d79-475f-8b21-2bea774cd641/g
|
||||
s/ada0f478-84a8-4641-a1f1-e32372d4bd53/c7bc51d2-330e-46da-a2e6-070909a602de/g
|
||||
s/ada0f478-84a8-4641-a3f1-d32362d4bd55/06bf47d6-c47a-4a84-a491-d2857b542e67/g
|
||||
s/ada0f478-84a8-4641-a3f1-e32372d4bd53/f0a6dda0-a5b2-4b30-977d-ac1b063b8820/g
|
||||
s/ad12w478-84a8-4641-a3w1-e32372q4bd53/a26fc0cf-2199-4fab-928d-4b13442ee871/g
|
||||
s/ada0f278-84a8-46w1-a3f1-w32372d4bd53/b1370336-450a-49e5-8c94-788136734a33/g
|
||||
s/name: Baseline of API Calls per User ARN/name: Baseline of API Calls per User ARN - MLTK/g
|
||||
s/name: Baseline of blocked outbound traffic from AWS/name: Baseline of blocked outbound traffic from AWS - MLTK/g
|
||||
s/name: Baseline of Network ACL Activity by ARN/name: Baseline of Network ACL Activity by ARN - MLTK/g
|
||||
s/name: Baseline of S3 Bucket deletion activity by ARN/name: Baseline of S3 Bucket deletion activity by ARN - MLTK/g
|
||||
s/name: Baseline of Security Group Activity by ARN/name: Baseline of Security Group Activity by ARN - MLTK/g
|
||||
s/name: Detect Spike in Network ACL Activity/name: Detect Spike in Network ACL Activity - MLTK/g
|
||||
s/name: Detect Spike in AWS API Activity/name: Detect Spike in AWS API Activity - MLTK/g
|
||||
s/name: Detect Spike in Security Group Activity/name: Detect Spike in Security Group Activity - MLTK/g
|
||||
s/name: Detect Spike in S3 Bucket deletion/name: Detect Spike in S3 Bucket deletion - MLTK/g
|
||||
s/name: Detect Spike in blocked Outbound Traffic from your AWS/name: Detect Spike in blocked Outbound Traffic from your AWS - MLTK/g
|
||||
Reference in New Issue
Block a user