get_all_aws_activity_from_ip_address.yml

name: Get All AWS Activity From IP Address
id: 446ec87a-85c6-40d4-b060-bea4498281d6
version: 1
date: '2018-03-19'
author: David Dorsey, Splunk
type: Investigation
status: deprecated
description: This search retrieves all the activity from a specific IP address and
  will create a table containing the time, ARN, username, the type of user, the IP
  address, the AWS region the activity was in, the API called, and whether or not
  the API call was successful.
search: '`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath
  output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName
  | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip
  | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
  inputs.
known_false_positives: ''
references: []
tags:
  analytic_story:
  - AWS Network ACL Activity
  - AWS Suspicious Provisioning Activities
  - Suspicious AWS S3 Activities
  - Suspicious AWS Traffic
  - Suspicious Cloud Instance Activities
  - Command And Control
  product:
  - Splunk Phantom
  security_domain: network