mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
23 lines
1.5 KiB
YAML
23 lines
1.5 KiB
YAML
name: Previously Seen Users in CloudTrail - Initial
|
|
id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5
|
|
version: 3
|
|
creation_date: '2020-05-28'
|
|
modification_date: '2026-05-13'
|
|
author: Rico Valdez, Splunk
|
|
status: production
|
|
description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days.
|
|
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count'
|
|
how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.
|
|
known_false_positives: No false positives have been identified at this time.
|
|
references: []
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
security_domain: network
|
|
custom_schedule:
|
|
cron_schedule: 0 2 * * 0
|
|
earliest_time: -90d@d
|
|
latest_time: -1d@d
|
|
schedule_window: auto
|