investigate_aws_activities_via_region_name.yml

name: Investigate AWS activities via region name
id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11
version: 1
date: '2018-02-09'
author: Bhavin Patel, Splunk
type: Investigation
datamodel: []
description: This search lists all the user activities logged by CloudTrail for a
  specific region in question and will create a table of the values of parameters
  requested, the type of the event and the response from the AWS API by each user
search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId
  as instanceId | stats values(eventName) by user instanceId vendor_region'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
known_false_positives: ''
references: []
tags:
  analytic_story:
  - AWS Cryptomining
  - Cloud Cryptomining
  - Suspicious AWS EC2 Activities
  - Suspicious AWS S3 Activities
  product:
  - Splunk Phantom
  required_fields:
  - _time
  - vendor_region
  - requestParameters.instancesSet.items{}.instanceId
  - eventName
  - user
  security_domain: network