mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
name: Get EC2 Launch Details
|
|
id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
|
|
version: 1
|
|
date: '2018-03-12'
|
|
author: Bhavin Patel, Splunk
|
|
type: Investigation
|
|
datamodel: []
|
|
description: This search returns some of the launch details for a EC2 instance.
|
|
search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId
|
|
as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress,
|
|
responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
|
|
as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
|
|
arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName'
|
|
how_to_implement: In order to implement this search, you must install the AWS App
|
|
for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
|
|
and configure your AWS description inputs.
|
|
known_false_positives: ''
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- AWS Cryptomining
|
|
- Cloud Cryptomining
|
|
- Suspicious AWS EC2 Activities
|
|
- AWS Security Hub Alerts
|
|
product:
|
|
- Splunk Phantom
|
|
- Splunk Security Analytics for AWS
|
|
required_fields:
|
|
- _time
|
|
- dest
|
|
- userIdentity.arn
|
|
- responseElements.instancesSet.items{}.instanceId
|
|
- responseElements.instancesSet.items{}.privateIpAddress
|
|
- responseElements.instancesSet.items{}.imageId
|
|
- responseElements.instancesSet.items{}.architecture
|
|
- responseElements.instancesSet.items{}.keyName
|
|
security_domain: network
|