mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
23 lines
1.1 KiB
YAML
23 lines
1.1 KiB
YAML
name: Get EC2 Launch Details
|
|
id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
|
|
version: 1
|
|
date: '2018-03-12'
|
|
description: This search returns some of the launch details for a EC2 instance.
|
|
how_to_implement: In order to implement this search, you must install the AWS App
|
|
for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
|
|
and configure your AWS description inputs.
|
|
author: Bhavin Patel, Splunk
|
|
inputs:
|
|
- dest
|
|
search: '| search sourcetype=aws:cloudtrail responseElements.instancesSet.items{}.instanceId=$dest$
|
|
|rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId
|
|
as instanceId, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress,
|
|
responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
|
|
as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
|
|
arn, awsRegion, instanceId, architecture, privateIpAddress, amiID, keyName'
|
|
tags:
|
|
analytics_story:
|
|
- AWS Cryptomining
|
|
- Cloud Cryptomining
|
|
- Suspicious AWS EC2 Activities
|