previously_seen_ec2_modifications_by_user.yml

name: Previously Seen EC2 Modifications By User
id: 4d69091b-d975-4267-85df-888bd41034eb
version: 1
date: '2018-04-05'
author: David Dorsey, Splunk
type: Baseline
datamodel: []
description: This search builds a table of previously seen ARNs that have launched
  a EC2 instance.
search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn
  userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime
  by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
  inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
known_false_positives: none
references: []
tags:
  analytic_story:
  - Unusual AWS EC2 Modifications
  detections:
  - EC2 Instance Modified With Previously Unseen User
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - userIdentity.arn
  - errorCode
  security_domain: network