get_ec2_launch_details.json

{
  "creation_date": "2018-03-12",
  "data_metadata": {
    "data_source": [
      "AWS CloudTrail Logs"
    ],
    "data_sourcetypes": [
      "aws:cloudtrail"
    ],
    "providing_technologies": [
      "AWS"
    ]
  },
  "description": "This search returns some of the launch details for a EC2 instance.",
  "entities": [
    "dest"
  ],
  "how_to_implement": "In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.",
  "id": "0e40fe83-3edb-4d86-8206-8fed36529ca6",
  "investigate": {
    "splunk": {
      "fields_required": [
        "dest"
      ],
      "schedule": {
        "cron_schedule": "",
        "earliest_time": "7200",
        "latest_time": "0"
      },
      "search": "| search sourcetype=aws:cloudtrail responseElements.instancesSet.items{}.instanceId={dest} |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as instanceId, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, instanceId, architecture, privateIpAddress, amiID, keyName"
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2018-03-12",
  "name": "Get EC2 Launch Details",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "spec_version": 2,
  "type": "splunk",
  "version": "1.0"
}