name: Suspicious Cloud Instance Activities
id: 8168ca88-392e-42f4-85a2-767579c660ce
version: 1
date: '2020-08-25'
author: David Dorsey, Splunk
description: Monitor your cloud infrastructure provisioning activities for behaviors
  originating from unfamiliar or unusual locations. These behaviors may indicate that
  malicious activities are occurring somewhere within your cloud environment.
narrative: Monitoring your cloud infrastructure logs allows you enable governance,
  compliance, and risk auditing. It is crucial for a company to monitor events and
  actions taken in the their cloud environments to ensure that your instances are
  not vulnerable to attacks. This Analytic Story identifies suspicious activities
  in your cloud compute instances and helps you respond and investigate those activities.
references:
- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
tags:
  analytic_story: Suspicious Cloud Instance Activities
  category:
  - Cloud Security
  product:
  - Splunk Security Analytics for AWS
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Security Monitoring