#Splunk dedup how to#
#Splunk dedup mac os x#

This query is adapted from the CIS Foundations Benchmark for AWS. In theory there should be none of these, so if we see one, we want to reach out to the account owner to understand why this user isn’t required to have MFA. The purpose of this query is to see who is logging as an IAMUser without supplying MFA. Since we have compliance monitoring around MFA on root, and notification of discovery of new accounts, we can correlate this event back to a new account being created and our cloud team putting MFA on the account for the first time. In this particular event, we see MFAUsed is No.

#Splunk dedup mac os x#

'userAgent': 'Mozilla/5.0 (Macintosh Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) The query looks like: index=cloudtrail 'userIdentity.type'=Root AND eventName=ConsoleLogin The first basic query is to find all the root login attempts. Sometimes there are useful filters in there. RequestParameters will change based on the API call. In this post they will all be 123456789012 recipientAccountId - AWS Account ID the event was for.userIdentity.type - Typically IAMUser or AssumeRole.userIdentity.arn - Depending on type, the attributes of userIdentity change, but the arn is always present.It’s either an IP, or an AWS service like sourceIPAddress - IP address the call came from.eventSource - This is the AWS service (ec2, s3, lambda, etc).Java/1.8.0_202 vendor/Oracle_Corporation]',Ī few key elements from a threat hunting perspective are: This is what a generic CloudTrail event looks like: I do not claim to be much of a Splunk expert. Splunk is the central tool we use for all log gathering and analysis. It functions both as an inventory gathering tool, and it helps us discover and manage our several hundred AWS accounts. A CloudWatch Event is configured in the GuardDuty master account to invoke a lambda that will push the event to a Splunk HTTP Event Collector (HEC) cluster.

As a global company, detectors are deployed in all AWS Regions.

We have cross account role that allows the security account to accept the invitation. New accounts are discovered by Antiope and auto-invited into the master. We leverage the GuardDuty Master/Member account concept. CloudTrail is deployed at account creation by a CloudFormation template created by the security team.

Splunk then points at the bucket and all our events are automatically ingested. We centralize all our CloudTrail events from all our accounts into a single bucket. We throw in a bit of Vulnerability Hunting and awareness with Antiope at the end.

#Splunk dedup how to#

The purpose was to give the audience a brief overview of how to conduct basic threat hunting in their CloudTrail and GuardDuty. This post is the reference section of my dev-chat at the first ever AWS re:Inforce conference in Boston.