AWS discreet alerts

[richie_martinez]

Hello, my name is Richie Martinez. I'm in my last year of undergrad school studying computer science. I currently work as a CSOC cyber analyst intern at Pacific Northwest National labs and I'm working on a project to create discreet alerts for EC2-VMs, IAM-identity findings and S3-storage buckets.

AWS organizes Findings into three categories:

1. EC2 - VMs
2. IAM - identity findings
3. S3 - storage buckets

Eventually, the PNNL CSOC may create additional discreet alerts for each of those categories, but for now, a single "catch-all" alert is utilized to fold in the Findings to the CSOC's workflow.

Any help for this project would be greatly appreciated.

Thank you,

Richie Martinez

richie.martinez@pnnl.gov

[richie_martinez]

Thank you so much for the quick response. I'm a noob, and what I've done so far is take the Splunk learning courses available to me and watched YouTube videos as well, on creating alerts. I've read over the material available to me at work (playbooks on related alerts) and I've been reading up on the topic areas in AWS. I have also found a Splunk quick reference guide on how to create queries, but I must admit it's all new to me so I was reaching out for any advice or pro tips. I have a background in construction and from that experience I learned the value of simple tricks or tips other people have learned from having experience. Even just presenting me with the question of if I have a search yet, is valuable advice. I don't but that helps a lot. Thanks again

[richgalloway]

What have you tried so far?  How have those efforts not met expectations?

An alert is just a scheduled search that takes action on what it finds.  Do you have a search, yet?

As is often the case, a specific question is more likely get a response than a vague "I need help" message.