aws_user_activities_by_user_field.json

{
    "creation_date": "2018-03-12",
    "data_metadata": {
        "data_source": [
            "AWS CloudTrail logs"
        ],
        "data_sourcetypes": [
            "aws:cloudtrail"
        ],
        "providing_technologies": [
            "AWS"
        ]
    },
    "description": "This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.",
    "entities": [
        "user"
    ],
    "how_to_implement": "You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.",
    "id": "bc91a8cd-35e7-4bb2-6140-e756cc46fd76",
    "investigate": {
        "splunk": [
            {
                "fields_required": [
                    "user"
                ]
            },
            {
                "schedule": {
                    "earliest_time_offset": 14400,
                    "latest_time_offset": 0
                }
            },
            {
                "search": "| search sourcetype=aws:cloudtrail user={user} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType "
            }
        ]
    },
    "maintainers": [
        {
            "company": "Splunk",
            "email": "bpatel@splunk.com",
            "name": "Bhavin Patel"
        }
    ],
    "modification_date": "2018-03-12",
    "name": "Investigate AWS User Activities by user field",
    "original_authors": [
        {
            "company": "Splunk",
            "email": "bpatel@splunk.com",
            "name": "Bhavin Patel"
        }
    ],
    "spec_version": 2,
    "type": "splunk"
}