create_a_list_of_approved_aws_service_accounts.yml

name: Create a list of approved AWS service accounts
id: 08ef80f5-6555-474b-bb2d-22e2aa4206a4
version: 2
date: '2018-12-03'
author: Bhavin Patel, Splunk
type: Baseline
datamodel: []
description: This search looks for successful API activity in CloudTrail within the
  last 30 days, filters out known users from the identity table, and outputs values
  of users into `aws_service_accounts.csv` lookup file.
search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
  [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
  | table identity | outputlookup aws_service_accounts | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. Please validate the service account entires in `aws_service_accounts.csv`,
  which is a lookup file created as a result of running this support search. Please
  remove the entries of service accounts that are not legitimate.
known_false_positives: none
references: []
tags:
  analytic_story:
  - AWS User Monitoring
  detections:
  - Detect AWS API Activities From Unapproved Accounts
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - errorCode
  - userName
  security_domain: network