AWS Ecr Container Upload Unknown User

AWS Ecr Container Upload Unknown User

Description

This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). A upload of a new container is normally done from only a few known users. When the user was never seen before, we should have a closer look into the event.

   Help

AWS Ecr Container Upload Unknown User Help

You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.

   Search

Open in Search