mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
54 lines
2.6 KiB
YAML
54 lines
2.6 KiB
YAML
name: Baseline Of Cloud Instances Launched
|
|
id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
|
|
version: 1
|
|
date: '2020-08-14'
|
|
author: David Dorsey, Splunk
|
|
type: Baseline
|
|
datamodel:
|
|
- Change
|
|
description: This search is used to build a Machine Learning Toolkit (MLTK) model
|
|
for how many instances are created in the environment. By default, the search uses
|
|
the last 90 days of data to build the model and the model is rebuilt weekly. The
|
|
model created by this search is then used in the corresponding detection search,
|
|
which identifies subsequent outliers in the number of instances created in a small
|
|
time window.
|
|
search: '| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created)
|
|
AND All_Changes.status=success AND All_Changes.object_category=instance by _time
|
|
span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched,
|
|
(random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
|
|
| eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
|
|
<= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction
|
|
instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1
|
|
dist=expon show_density=true'
|
|
how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
|
|
need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
|
|
installed, along with any required dependencies. Depending on the number of users
|
|
in your environment, you may also need to adjust the value for max_inputs in the
|
|
MLTK settings for the DensityFunction algorithm, then ensure that the search completes
|
|
in a reasonable timeframe. By default, the search builds the model using the past
|
|
90 days of data. You can modify the search window to build the model over a longer
|
|
period of time, which may give you better results. You may also want to periodically
|
|
re-run this search to rebuild the model with the latest data.\
|
|
|
|
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
|
|
known_false_positives: none
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- Cloud Cryptomining
|
|
- Suspicious Cloud Instance Activities
|
|
deployments:
|
|
- Weekly Model Rebuild 90 Day Lookback
|
|
detections:
|
|
- Abnormally High Number Of Cloud Instances Launched
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- All_Changes.action
|
|
- All_Changes.status
|
|
- All_Changes.object_category
|
|
security_domain: network
|