Merge branch 'develop' into coverage_update

detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

@@ -0,0 +1,35 @@
+name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
+id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
+version: 2
+date: '2020-07-21'
+description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub
+  inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
+type: ESCU
+references: []
+author: Bhavin Patel, Splunk
+search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance 
+| rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*) 
+| rename instance as dest 
+| bucket span=4h _time 
+| stats count AS alerts by _time dest 
+| eventstats avg(alerts)
+    as total_launched_avg, stdev(alerts) as total_launched_stdev 
+| eval
+    threshold_value = 4
+| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev
+    * threshold_value), 1, 0) 
+| search isOutlier=1 
+| table _time dest alerts|`detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
+known_false_positives: None
+tags:
+  analytics_story:
+  - AWS Security Hub Alerts
+  cis20:
+  - CIS 13
+  nist:
+  - DE.DP
+  - DE.AE
+  security_domain: network
+  asset_type: AWS Instance

detections/detect_spike_in_security_hub_alerts_for_user.yml

@@ -0,0 +1,32 @@
+name: Detect Spike in AWS Security Hub Alerts for User
+id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222
+version: 2
+date: '2020-07-21'
+description: This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals.
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub
+  inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
+type: ESCU
+references: []
+author: Bhavin Patel, Splunk
+search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time 
+| stats count AS alerts by _time user 
+| eventstats avg(alerts)
+    as total_launched_avg, stdev(alerts) as total_launched_stdev 
+| eval
+    threshold_value = 2
+| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev
+    * threshold_value), 1, 0) 
+| search isOutlier=1 
+| table _time user alerts |`detect_spike_in_aws_security_hub_alerts_for_user_filter`'
+known_false_positives: None
+tags:
+  analytics_story:
+  - AWS Security Hub Alerts
+  cis20:
+  - CIS 13
+  nist:
+  - DE.DP
+  - DE.AE
+  security_domain: network
+  asset_type: AWS Instance

macros/aws_securityhub_firehose.yml

@@ -0,0 +1,4 @@
+definition: sourcetype="aws:securityhub:firehose"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: aws_securityhub_firehose

response_tasks/aws_investigate_user_activities_by_arn.yml

@@ -26,3 +26,4 @@ tags:
   - Suspicious AWS S3 Activities
   - Suspicious AWS Traffic
   - Unusual AWS EC2 Modifications
+  - AWS Security Hub Alerts

response_tasks/get_ec2_instance_details_by_instanceid.yml

@@ -24,3 +24,4 @@ tags:
   - Cloud Cryptomining
   - Suspicious AWS EC2 Activities
   - Unusual AWS EC2 Modifications
+  - AWS Security Hub Alerts

response_tasks/get_ec2_launch_details.yml

@@ -20,3 +20,4 @@ tags:
   - AWS Cryptomining
   - Cloud Cryptomining
   - Suspicious AWS EC2 Activities
+  - AWS Security Hub Alerts

stories/aws_security_hub_alerts.yml

@@ -0,0 +1,15 @@
+name: AWS Security Hub Alerts
+id: 2f2f610a-d64d-48c2-b57c-96722b49ab5a
+version: 1
+date: '2020-08-04'
+description: 'This story is focused around detecting Security Hub alerts generated from AWS'
+narrative: 'AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.'
+author: Bhavin Patel, Splunk
+type: ESCU
+references:
+- https://aws.amazon.com/security-hub/features/
+tags:
+  analytics_story: AWS Security Hub Alerts
+  usecase: Security Monitoring
+  category:
+  - Cloud Security