{
  "channel": "ESCU",
  "creation_date": "2018-02-23",
  "data_metadata": {
    "data_source": [
      "AWS CloudTrail logs"
    ],
    "data_sourcetypes": [
      "aws:cloudtrail"
    ],
    "providing_technologies": [
      "AWS"
    ]
  },
  "eli5": "In this support search, we look for console login events by a particular user and create an initial baseline cache for the previous seven days, including the earliest and latest times a particular user ARN is seen in our dataset, grouped by the ARN value.",
  "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in <code>previously_seen_users_console_logins.csv</code>, which is a lookup file created as a result of running this support search.",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2018-02-23",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "scheduling": {
    "earliest_time": "-30d@d",
    "latest_time": "-10m@m"
  },
  "search": "sourcetype=aws:cloudtrail eventName=ConsoleLogin | rename userIdentity.arn as arn | stats earliest(_time) as earliest latest(_time) as latest by arn | outputlookup previously_seen_users_console_logins.csv | stats count",
  "search_description": "This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times we have encountered this user in our dataset, grouped by ARN, within the last 30 days.",
  "search_id": "fc0edc95-ff2b-48b0-9f6f-63da3789fd03",
  "search_name": "Previously seen users in CloudTrail",
  "search_type": "support",
  "spec_version": 1,
  "version": "1.0"
}