mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
44 lines
1.8 KiB
JSON
44 lines
1.8 KiB
JSON
{
|
|
"channel": "ESCU",
|
|
"creation_date": "2018-03-16",
|
|
"data_metadata": {
|
|
"data_source": [
|
|
"AWS CloudTrail logs"
|
|
],
|
|
"data_sourcetypes": [
|
|
"aws:cloudtrail"
|
|
],
|
|
"providing_technologies": [
|
|
"AWS"
|
|
]
|
|
},
|
|
"eli5": "This search includes any event name that begins with \"run\" or \"create,\" and then determines the first and last time these events were seen for each IP address that initiated the action. The search then consults a <b>GeoIP</b> database to determine the physical location of this IP address. This table outputs to a file.",
|
|
"how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2018-03-16",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"earliest_time": "-90d@d",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count",
|
|
"search_description": "This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something.",
|
|
"search_id": "ac88e6a0-4fba-4dfd-b7b9-8964df7d1aee",
|
|
"search_name": "Previously Seen AWS Provisioning Activity Sources",
|
|
"search_type": "support",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|