Abnormally High AWS Instances Launched By User
This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances.
This content is not mapped to any local saved search. Add mapping
Abnormally High AWS Instances Launched By User Help
You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment.
Open in Search