mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
35 lines
1.7 KiB
YAML
35 lines
1.7 KiB
YAML
name: Suspicious Cloud Provisioning Activities
|
|
id: 51045ded-1575-4ba6-aef7-af6c73cffd86
|
|
version: 1
|
|
date: '2018-08-20'
|
|
author: David Dorsey, Splunk
|
|
description: Monitor your cloud infrastructure provisioning activities for behaviors
|
|
originating from unfamiliar or unusual locations. These behaviors may indicate that
|
|
malicious activities are occurring somewhere within your cloud environment.
|
|
narrative: 'Because most enterprise cloud infrastructure activities originate from
|
|
familiar geographic locations, monitoring for activity from unknown or unusual regions
|
|
is an important security measure. This indicator can be especially useful in environments
|
|
where it is impossible to add specific IPs to an allow list because they vary.\
|
|
|
|
This Analytic Story was designed to provide you with flexibility in the precision
|
|
you employ in specifying legitimate geographic regions. It can be as specific as
|
|
an IP address or a city, or as broad as a region (think state) or an entire country.
|
|
By determining how precise you want your geographical locations to be and monitoring
|
|
for new locations that haven''t previously accessed your environment, you can detect
|
|
adversaries as they begin to probe your environment. Since there are legitimate
|
|
reasons for activities from unfamiliar locations, this is not a standalone indicator.
|
|
Nevertheless, location can be a relevant piece of information that you may wish
|
|
to investigate further.'
|
|
references:
|
|
- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
|
|
tags:
|
|
analytic_story: Suspicious Cloud Provisioning Activities
|
|
category:
|
|
- Cloud Security
|
|
product:
|
|
- Splunk Security Analytics for AWS
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Security Monitoring
|