Suspcious cloud user activites spl bugs

baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml

@@ -18,14 +18,16 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
   which may give you better results. You may also want to periodically re-run this
   search to rebuild the model with the latest data.'
 author: David Dorsey, Splunk
-search: '| tstats count as api_calls from datamodel=Change where
-   All_Changes.user!=unknown All_Changes.status=success
-   by All_Changes.user _time span=1h
-   | `drop_dm_object_name("All_Changes")`
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-  | table _time api_calls, user, HourOfDay, isWeekend
-  | eventstats dc(api_calls) as count by user, HourOfDay, isWeekend | where count > 1
-  | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true'
+search: '| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h 
+| `drop_dm_object_name("All_Changes")` 
+| eval HourOfDay=strftime(_time, "%H") 
+| eval HourOfDay=floor(HourOfDay/4)*4 
+| eval DayOfWeek=strftime(_time, "%w") 
+| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
+| table _time api_calls, user, HourOfDay, isWeekend 
+| eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend 
+| where api_calls >= 1 
+| fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true'
 tags:
   analytics_story:
   - Suspicious Cloud User Activities

baselines/baseline_of_cloud_security_group_api_calls_per_user.yml

@@ -15,14 +15,16 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi
   which may give you better results. You may also want to periodically re-run this
   search to rebuild the model with the latest data.'
 author: David Dorsey, Splunk
-search: '| tstats count as security_group_api_calls from datamodel=Change where
-   All_Changes.object_category=firewall All_Changes.status=success
-   by All_Changes.user _time span=1h
-   | `drop_dm_object_name("All_Changes")`
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-  | table _time security_group_api_calls, user, HourOfDay, isWeekend
-  | eventstats dc(security_group_api_calls) as count by user, HourOfDay, isWeekend | where count > 1
-  | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true'
+search: '| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h 
+| `drop_dm_object_name("All_Changes")` 
+| eval HourOfDay=strftime(_time, "%H") 
+| eval HourOfDay=floor(HourOfDay/4)*4 
+| eval DayOfWeek=strftime(_time, "%w") 
+| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
+| table _time security_group_api_calls, user, HourOfDay, isWeekend 
+| eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend 
+| where security_group_api_calls >= 1 
+| fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true'
 tags:
   analytics_story:
   - Suspicious Cloud User Activities

baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml

@@ -10,7 +10,7 @@ author: David Dorsey, Splunk
 search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change 
   where All_Changes.user_type=AssumedRole AND All_Changes.status=success
   by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
-  eventstats min(firstTimeSeen) as globalFirstTime
+  | eventstats min(firstTimeSeen) as globalFirstTime
   | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) 
   | table user, command, firstTimeSeen, lastTimeSeen, enough_data
   | outputlookup previously_seen_cloud_api_calls_per_user_role'

detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -9,19 +9,23 @@ how_to_implement: You must be ingesting your cloud infrastructure logs. You also
 type: ESCU
 references: []
 author: David Dorsey, Splunk
-search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success
-   by All_Changes.user _time span=1h
-   | `drop_dm_object_name("All_Changes")`
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-   | join HourOfDay isWeekend [summary cloud_excessive_api_calls_v1]
-   | where cardinality >=16
-   | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier
-   | where isOutlier=1
-   | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
-   | where api_calls > expected_upper_threshold
-   | eval distance_from_threshold = api_calls - expected_upper_threshold
-   | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold
-   | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`'
+search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h 
+| `drop_dm_object_name("All_Changes")` 
+| eval HourOfDay=strftime(_time, "%H") 
+| eval HourOfDay=floor(HourOfDay/4)*4 
+| eval DayOfWeek=strftime(_time, "%w") 
+| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
+| join user HourOfDay isWeekend 
+    [ summary cloud_excessive_api_calls_v1] 
+| where cardinality >=16
+| apply cloud_excessive_api_calls_v1 threshold=0.005 
+| rename "IsOutlier(api_calls)" as isOutlier
+| where isOutlier=1 
+| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) 
+| where api_calls > expected_upper_threshold 
+| eval distance_from_threshold = api_calls - expected_upper_threshold 
+| table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold 
+| `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`'
 known_false_positives: ''
 tags:
   analytics_story:

detections/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -9,20 +9,23 @@ how_to_implement: You must be ingesting your cloud infrastructure logs. You also
 type: ESCU
 references: []
 author: David Dorsey, Splunk
-search: '| tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where
-   All_Changes.object_category=firewall AND All_Changes.status=success
-   by All_Changes.user _time span=1h
-   | `drop_dm_object_name("All_Changes")`
-   | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-   | join HourOfDay isWeekend [summary cloud_excessive_security_group_api_calls_v1]
-   | where cardinality >=16
-   | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier
-   | where isOutlier=1
-   | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
-   | where security_group_api_calls > expected_upper_threshold
-   | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold
-   | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold
-   | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
+search: '| tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h 
+| `drop_dm_object_name("All_Changes")` 
+| eval HourOfDay=strftime(_time, "%H") 
+| eval HourOfDay=floor(HourOfDay/4)*4 
+| eval DayOfWeek=strftime(_time, "%w") 
+| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
+| join user HourOfDay isWeekend 
+    [ summary cloud_excessive_security_group_api_calls_v1] 
+| where cardinality >=16 
+| apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 
+| rename "IsOutlier(security_group_api_calls)" as isOutlier 
+| where isOutlier=1 
+| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) 
+| where security_group_api_calls > expected_upper_threshold 
+| eval distance_from_threshold = security_group_api_calls - expected_upper_threshold 
+| table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold 
+| `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
 known_false_positives: ''
 tags:
   analytics_story:

detections/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -22,10 +22,11 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
   where All_Changes.user_type=AssumedRole AND All_Changes.status=success
   by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")`
   | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data
+  | eventstats max(enough_data) as enough_data 
   | where enough_data=1
-  | eval firstTimeSeenSrc=min(firstTimeSeen)
-  | where isnull(firstTimeSeenSrc) OR firstTime > relative_time(now(), `cloud_api_calls_from_previously_unseen_user_roles_activity_window`)
-  | table firstTime, src, user, object, command
+  | eval firstTimeSeenUserApiCall=min(firstTimeSeen)
+  | where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall > relative_time(now(), `cloud_api_calls_from_previously_unseen_user_roles_activity_window`)
+  | table firstTime, user, object, command
   | `cloud_api_calls_from_previously_unseen_user_roles_filter`'
 known_false_positives: "."
 tags: