mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
34 lines
1.6 KiB
YAML
34 lines
1.6 KiB
YAML
name: Previously seen users in CloudTrail
|
|
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd03
|
|
version: 1
|
|
date: '2018-04-30'
|
|
author: Jason Brewer, Splunk
|
|
type: batch
|
|
datamodel: []
|
|
description: This search looks for CloudTrail events where a user logs into the console,
|
|
then creates a baseline of the latest and earliest times, City, Region, and Country
|
|
we have encountered this user in our dataset, grouped by ARN, within the last 30
|
|
days. NOTE - This baseline search is deprecated and has been updated to use the
|
|
Authentication Datamodel
|
|
search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
|
|
src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
|
|
stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region
|
|
Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count'
|
|
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
|
|
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
|
|
inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`,
|
|
which is a lookup file created as a result of running this support search.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Suspicious AWS Login Activities
|
|
detections:
|
|
- Detect AWS Console Login by User from New Country
|
|
- Detect AWS Console Login by User from New Region
|
|
- Detect AWS Console Login by User from New City
|
|
- Detect new user AWS Console Login
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|