name: Get EC2 Launch Details
id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
version: 1
date: '2018-03-12'
description: This search returns some of the launch details for a EC2 instance.
how_to_implement: In order to implement this search, you must install the AWS App
  for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
  and configure your AWS description inputs.
author: Bhavin Patel, Splunk
inputs:
- dest
search: '| search sourcetype=aws:cloudtrail responseElements.instancesSet.items{}.instanceId=$dest$
  |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId
  as instanceId, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress,
  responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
  as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
  arn, awsRegion, instanceId, architecture, privateIpAddress, amiID, keyName'
tags:
  analytics_story:
  - AWS Cryptomining
  - Cloud Cryptomining
  - Suspicious AWS EC2 Activities