From 2f04c868e415fa6015ff0203fa80a422128d98ab Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 6 Aug 2020 14:44:50 -0700 Subject: [PATCH] new detections for security hub alerts --- ...s_security_hub_alerts_for_ec2_instance.yml | 35 +++++++++++++++++++ ..._spike_in_security_hub_alerts_for_user.yml | 32 +++++++++++++++++ macros/aws_securityhub_firehose.yml | 4 +++ ...aws_investigate_user_activities_by_arn.yml | 1 + ...get_ec2_instance_details_by_instanceid.yml | 1 + response_tasks/get_ec2_launch_details.yml | 1 + stories/aws_security_hub_alerts.yml | 15 ++++++++ 7 files changed, 89 insertions(+) create mode 100644 detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml create mode 100644 detections/detect_spike_in_security_hub_alerts_for_user.yml create mode 100644 macros/aws_securityhub_firehose.yml create mode 100644 stories/aws_security_hub_alerts.yml diff --git a/detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml new file mode 100644 index 0000000000..7f05f630eb --- /dev/null +++ b/detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -0,0 +1,35 @@ +name: Detect Spike in AWS Security Hub Alerts for EC2 Instance +id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 +version: 2 +date: '2020-07-21' +description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub + inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. +type: ESCU +references: [] +author: Bhavin Patel, Splunk +search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance +| rex field=findings{}.Resources{}.Id .*instance/(?.*) +| rename instance as dest +| bucket span=4h _time +| stats count AS alerts by _time dest +| eventstats avg(alerts) + as total_launched_avg, stdev(alerts) as total_launched_stdev +| eval + threshold_value = 4 +| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev + * threshold_value), 1, 0) +| search isOutlier=1 +| table _time dest alerts|`detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`' +known_false_positives: None +tags: + analytics_story: + - AWS Security Hub Alerts + cis20: + - CIS 13 + nist: + - DE.DP + - DE.AE + security_domain: network + asset_type: AWS Instance diff --git a/detections/detect_spike_in_security_hub_alerts_for_user.yml b/detections/detect_spike_in_security_hub_alerts_for_user.yml new file mode 100644 index 0000000000..af0649ef3f --- /dev/null +++ b/detections/detect_spike_in_security_hub_alerts_for_user.yml @@ -0,0 +1,32 @@ +name: Detect Spike in AWS Security Hub Alerts for User +id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222 +version: 2 +date: '2020-07-21' +description: This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals. +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub + inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval. +type: ESCU +references: [] +author: Bhavin Patel, Splunk +search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"= AwsIamUser | rename findings{}.Resources{}.Id as user | bucket span=4h _time +| stats count AS alerts by _time user +| eventstats avg(alerts) + as total_launched_avg, stdev(alerts) as total_launched_stdev +| eval + threshold_value = 2 +| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev + * threshold_value), 1, 0) +| search isOutlier=1 +| table _time user alerts |`detect_spike_in_aws_security_hub_alerts_for_user_filter`' +known_false_positives: None +tags: + analytics_story: + - AWS Security Hub Alerts + cis20: + - CIS 13 + nist: + - DE.DP + - DE.AE + security_domain: network + asset_type: AWS Instance diff --git a/macros/aws_securityhub_firehose.yml b/macros/aws_securityhub_firehose.yml new file mode 100644 index 0000000000..b362424495 --- /dev/null +++ b/macros/aws_securityhub_firehose.yml @@ -0,0 +1,4 @@ +definition: sourcetype="aws:securityhub:firehose" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: aws_securityhub_firehose diff --git a/response_tasks/aws_investigate_user_activities_by_arn.yml b/response_tasks/aws_investigate_user_activities_by_arn.yml index e7d26efce7..e783dcf79e 100644 --- a/response_tasks/aws_investigate_user_activities_by_arn.yml +++ b/response_tasks/aws_investigate_user_activities_by_arn.yml @@ -26,3 +26,4 @@ tags: - Suspicious AWS S3 Activities - Suspicious AWS Traffic - Unusual AWS EC2 Modifications + - AWS Security Hub Alerts diff --git a/response_tasks/get_ec2_instance_details_by_instanceid.yml b/response_tasks/get_ec2_instance_details_by_instanceid.yml index b28bdcedbe..e52331de2d 100644 --- a/response_tasks/get_ec2_instance_details_by_instanceid.yml +++ b/response_tasks/get_ec2_instance_details_by_instanceid.yml @@ -24,3 +24,4 @@ tags: - Cloud Cryptomining - Suspicious AWS EC2 Activities - Unusual AWS EC2 Modifications + - AWS Security Hub Alerts diff --git a/response_tasks/get_ec2_launch_details.yml b/response_tasks/get_ec2_launch_details.yml index 3736eabbdc..2cbf0c910a 100644 --- a/response_tasks/get_ec2_launch_details.yml +++ b/response_tasks/get_ec2_launch_details.yml @@ -20,3 +20,4 @@ tags: - AWS Cryptomining - Cloud Cryptomining - Suspicious AWS EC2 Activities + - AWS Security Hub Alerts diff --git a/stories/aws_security_hub_alerts.yml b/stories/aws_security_hub_alerts.yml new file mode 100644 index 0000000000..b3af17e5da --- /dev/null +++ b/stories/aws_security_hub_alerts.yml @@ -0,0 +1,15 @@ +name: AWS Security Hub Alerts +id: 2f2f610a-d64d-48c2-b57c-96722b49ab5a +version: 1 +date: '2020-08-04' +description: 'This story is focused around detecting Security Hub alerts generated from AWS' +narrative: 'AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.' +author: Bhavin Patel, Splunk +type: ESCU +references: +- https://aws.amazon.com/security-hub/features/ +tags: + analytics_story: AWS Security Hub Alerts + usecase: Security Monitoring + category: + - Cloud Security