Getting Data In

Filter AWS Cloudtrail readonly events

ColinJacksonPS
Path Finder

Does anybody know a good way to filter out AWS Cloudtrail readonly events?

 

This is what I have on my HF and jumping through hoops to get this on the IDM for Splunk Cloud.

 

[cloudtrail_read_only]
REGEX = "^Describe|Get|List\p{Lu}|LookupEvents"
DEST_KEY = queue
FORMAT = nullQueue


and this to props.conf:

[aws:cloudtrail]
#Strip out readOnly AWS events (i.e. Describe*, List*)
TRANSFORMS-cloudtrail_read_only = cloudtrail_read_only

 

Doesn't seem to be filtering. Thoughts?

Labels (2)
Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ColinJacksonPS 

You can try following to send readOnly them to nullQueue. the REGEX matches "readOnly' = true in every event and if it find a match then those events won't be indexed. So make sure the readOnly events containing the operations/eventNAme that you do not want to index.

aws:cloudtrail is a default sourcetype when you set this in props.conf it applies to everything at platform level, instead if you want to limit to particular source/host use source:: , host:: type stanzas as provided here in example.

#props.conf
[your_sourcetype/source::<source>/host::<hostname>]
TRANSFORMS-nullq= setreadonlytonullQ
 
#transforms.conf
[setreadonlytonullQ]
REGEX = \"readOnly\"\:\s+true
DEST_KEY = queue
FORMAT = nullQueue

 ----

An upvote would be appreciated and accept solutions if it helps!

venkatasri
SplunkTrust
SplunkTrust

@ColinJacksonPS Appreciate if you could accept the solution. Hope it helped for your case.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ColinJacksonPS 

Can you share sample event how it looks like covering Get*, List*, LookupEvents etc.. I am sure they don not start at very beginning of event since you mentioned ^ in regex which indicates very beginning of event.  REGEX shall be changed to match with event.

0 Karma

ColinJacksonPS
Path Finder

Here's what I can share. If this is working, readOnly=true should return no results, or at least those listed.  Raw, JSON formatted, and simple stats output. 

Screen Shot 2021-06-23 at 9.27.21 PM.pngScreen Shot 2021-06-23 at 9.26.57 PM.pngScreen Shot 2021-06-23 at 9.27.11 PM.png

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...