mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
mvelazco
33 lines
1.4 KiB
YAML
33 lines
1.4 KiB
YAML
author: Bhavin Patel, Splunk
|
|
date: '2018-02-12'
|
|
description: This search queries AWS description logs and returns all the information
|
|
about a specific instance via the instanceId field
|
|
how_to_implement: In order to implement this search, you must install the AWS App
|
|
for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
|
|
and configure your AWS description inputs.
|
|
id: f3db4d1b-5f33-4b01-c541-c7ah9514c242
|
|
inputs:
|
|
- instanceId
|
|
name: Get EC2 Instance Details by instanceId
|
|
search: '| search sourcetype="aws:description" source="*:ec2_instances"| dedup id
|
|
sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath
|
|
output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address
|
|
== "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id,
|
|
placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id,
|
|
tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address
|
|
as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement
|
|
as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name,
|
|
vpc_id as VPC'
|
|
tags:
|
|
analytic_story:
|
|
- AWS Cryptomining
|
|
- Cloud Cryptomining
|
|
- Suspicious AWS EC2 Activities
|
|
- Unusual AWS EC2 Modifications
|
|
- AWS Security Hub Alerts
|
|
product:
|
|
- Splunk Phantom
|
|
- Splunk Security Analytics for AWS
|
|
type: response
|
|
version: 1
|