mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
25 lines
1.1 KiB
YAML
25 lines
1.1 KiB
YAML
name: Suspicious Cloud Instance Activities
|
|
id: 8168ca88-392e-42f4-85a2-767579c660ce
|
|
version: 1
|
|
date: '2020-08-25'
|
|
author: David Dorsey, Splunk
|
|
description: Monitor your cloud infrastructure provisioning activities for behaviors
|
|
originating from unfamiliar or unusual locations. These behaviors may indicate that
|
|
malicious activities are occurring somewhere within your cloud environment.
|
|
narrative: Monitoring your cloud infrastructure logs allows you enable governance,
|
|
compliance, and risk auditing. It is crucial for a company to monitor events and
|
|
actions taken in the their cloud environments to ensure that your instances are
|
|
not vulnerable to attacks. This Analytic Story identifies suspicious activities
|
|
in your cloud compute instances and helps you respond and investigate those activities.
|
|
references:
|
|
- https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
|
|
tags:
|
|
category:
|
|
- Cloud Security
|
|
product:
|
|
- Splunk Security Analytics for AWS
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Security Monitoring
|