From 6d152fdf0d1063909e1b35ba405f68f2117b4d60 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 12 Nov 2021 11:03:40 -0800 Subject: [PATCH 1/2] spll update --- detections/cloud/aws_iam_accessdenied_discovery_events.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index f14b82140d..53baae2392 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -1,7 +1,7 @@ name: AWS IAM AccessDenied Discovery Events id: 3e1f1568-9633-11eb-a69c-acde48001122 -version: 1 -date: '2021-04-05' +version: 2 +date: '2021-11-12' author: Michael Haag, Splunk type: Anomaly datamodel: [] @@ -11,7 +11,7 @@ description: The following detection identifies excessive AccessDenied events wi is not available with the key stolen therefore these events will be generated. search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) - as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) + as lastTime, dc(eventName) as methods, dc(eventSource) as sources by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`' From 700383c15f7028200ebef51a7fe67f8f29080162 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Nov 2021 19:26:05 +0000 Subject: [PATCH 2/2] Added detection testing service results inAWS IAM AccessDenied Discovery Events --- detections/cloud/aws_iam_accessdenied_discovery_events.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index 53baae2392..fce7e3c4ed 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -11,10 +11,9 @@ description: The following detection identifies excessive AccessDenied events wi is not available with the key stolen therefore these events will be generated. search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) - as lastTime, dc(eventName) as methods, dc(eventSource) as sources - by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources - >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `aws_iam_accessdenied_discovery_events_filter`' + as lastTime, dc(eventName) as methods, dc(eventSource) as sources by src_ip, userIdentity.arn, + _time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`' how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. known_false_positives: It is possible to start this detection will need to be tuned