Abnormally High AWS Instances Terminated By User
This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window
This content is not mapped to any local saved search. Add mapping
Abnormally High AWS Instances Terminated By User Help
You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
Open in Search