update_previously_seen_users_in_cloudtrail.yml

name: Update previously seen users in CloudTrail
id: 06c036e6-d6d7-4daa-bd76-411c3d356031
version: 1
date: '2018-04-30'
description: This search looks for CloudTrail events where a user logs into the console,
  then updates the baseline of the latest and earliest times, City, Region, and Country
  we have encountered this user in our dataset, grouped by ARN, within the last hour.
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`,
  which is a lookup file created as a result of running this support search.
author: Jason Brewer, Splunk
search: '`cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation
  src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) |
  stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region
  Country | inputlookup append=t previously_seen_users_console_logins.csv | stats
  min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country
  | outputlookup previously_seen_users_console_logins.csv'
tags:
  analytics_story:
  - Suspicious AWS Login Activities
  detections:
  - Detect AWS Console Login by User from New Country
  - Detect AWS Console Login by User from New Region
  - Detect AWS Console Login by User from New City
  - Detect new user AWS Console Login