Detect Spike in AWS Security Hub Alerts for User

Status: experimental
Severity: low
Group by: _time, user
Author: Bhavin Patel, Splunk
Source: github.com/splunk/security_content

The following analytic identifies a spike in the number of AWS Security Hub alerts for an AWS IAM User within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect significant deviations. This activity is significant as a sudden increase in alerts for a specific user may indicate suspicious behavior or a potential security incident. If confirmed malicious, this could signify an ongoing attack, unauthorized access, or misuse of IAM credentials, potentially leading to data breaches or further exploitation.

Rule body splunk

name: Detect Spike in AWS Security Hub Alerts for User
id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222
version: 11
creation_date: '2020-08-06'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies a spike in the number of AWS Security Hub alerts for an AWS IAM User within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect significant deviations. This activity is significant as a sudden increase in alerts for a specific user may indicate suspicious behavior or a potential security incident. If confirmed malicious, this could signify an ongoing attack, unauthorized access, or misuse of IAM credentials, potentially leading to data breaches or further exploitation.
data_source:
    - AWS Security Hub
search: |-
    `aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser
      | rename findings{}.Resources{}.Id as user
      | bucket span=4h _time
      | stats count AS alerts
        BY _time user
      | eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev
      | eval threshold_value = 2
      | eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0)
      | search isOutlier=1
      | table _time user alerts
      | `detect_spike_in_aws_security_hub_alerts_for_user_filter`
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
known_false_positives: No false positives have been identified at this time.
references: []
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: Spike in AWS Security Hub alerts for user - $user$
analytic_story:
    - AWS Security Hub Alerts
    - Critical Alerts
asset_type: AWS Instance
mitre_attack_id: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network

Stages and Predicates

Stage 1: `search`

`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser

Stage 2: `rename`

| rename findings{}.Resources{}.Id as user

Stage 3: `bucket`

| bucket span=4h _time

Stage 4: `stats`

| stats count AS alerts
    BY _time user

Stage 5: `eventstats`

| eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev

Stage 6: `eval`

| eval threshold_value = 2

Stage 7: `eval`

| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0)

isOutlier =

ifalerts > concat(total_launched_avg, times(total_launched_stdev, threshold_value))1

else0

Stage 8: `search`

| search isOutlier=1

Stage 9: `table`

| table _time user alerts

Stage 10: `search`

| `detect_spike_in_aws_security_hub_alerts_for_user_filter`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`"findings{}.Resources{}.Type"`	eq	`AwsIamUser`
`isOutlier`	eq	`1`
`sourcetype`	eq	`aws:securityhub:finding`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Detect Spike in AWS Security Hub Alerts for User

Rule body splunk

Stages and Predicates

Stage 1: `search`

Stage 2: `rename`

Stage 3: `bucket`

Stage 4: `stats`

Stage 5: `eventstats`

Stage 6: `eval`

Stage 7: `eval`

Stage 8: `search`

Stage 9: `table`

Stage 10: `search`

Indicators

Keyboard shortcuts

Search operators

Detect Spike in AWS Security Hub Alerts for User

Rule body splunk

Stages and Predicates

Stage 1: search

Stage 2: rename

Stage 3: bucket

Stage 4: stats

Stage 5: eventstats

Stage 6: eval

Stage 7: eval

Stage 8: search

Stage 9: table

Stage 10: search

Indicators

Stage 1: `search`

Stage 2: `rename`

Stage 3: `bucket`

Stage 4: `stats`

Stage 5: `eventstats`

Stage 6: `eval`

Stage 7: `eval`

Stage 8: `search`

Stage 9: `table`

Stage 10: `search`