mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
mvelazco
27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
author: Bhavin Patel, Splunk
|
|
date: '2018-03-12'
|
|
description: This search returns some of the launch details for a EC2 instance.
|
|
how_to_implement: In order to implement this search, you must install the AWS App
|
|
for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later)
|
|
and configure your AWS description inputs.
|
|
id: 0e40fe83-3edb-4d86-8206-8fed36529ca6
|
|
inputs:
|
|
- dest
|
|
name: Get EC2 Launch Details
|
|
search: '| search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as
|
|
arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress
|
|
as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture
|
|
as architecture, responseElements.instancesSet.items{}.keyName as keyName | table
|
|
arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName'
|
|
tags:
|
|
analytic_story:
|
|
- AWS Cryptomining
|
|
- Cloud Cryptomining
|
|
- Suspicious AWS EC2 Activities
|
|
- AWS Security Hub Alerts
|
|
product:
|
|
- Splunk Phantom
|
|
- Splunk Security Analytics for AWS
|
|
type: response
|
|
version: 1
|