admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inCloud Compute Instance Created In Previously Unused Region

Browse Source
This commit is contained in:
root
2020-11-30 22:19:34 +00:00
parent 48a1d3af9e
commit 9655f9245a
1 changed files with 18 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+18 -17
View File
@@ -5,24 +5,24 @@ date: '2020-09-02'
description: This search looks at cloud-infrastructure events where an instance is
created in any region within the last hour and then compares it to a lookup file
of previously seen regions where instances have been created.
how_to_implement: "You must be ingesting your cloud infrastructure logs from your
cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
to build the initial table of images observed and times. You must also enable the second
baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and
to age out old data. You can also provide additional filtering for this search by
customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro."
how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
to build the initial table of images observed and times. You must also enable the
second baseline search `Previously Seen Cloud Regions - Update` to keep this table
up to date and to age out old data. You can also provide additional filtering for
this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter`
macro.
type: ESCU
references: []
author: David Dorsey, Splunk
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user
| `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data
| eventstats max(enough_data) as enough_data
| where enough_data=1
| eval firstTimeSeenRegion=min(firstTimeSeen)
| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h")
| table firstTime, user, dest, count , vendor_region
| `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_in_previously_unused_region_filter`'
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region,
All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions
vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats
max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen)
| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(),
"-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)`
| `cloud_compute_instance_created_in_previously_unused_region_filter`'
known_false_positives: It's possible that a user has unknowingly started an instance
in a new region. Please verify that this activity is legitimate.
tags:
@@ -42,5 +42,6 @@ tags:
risk_score: 20
risk_object_type: user
risk_object: user
automated_detection_testing: passed
dataset:
- https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json