Splunk SOAR (f.k.a. Phantom)

Example of how to protect an EC2 group from malicious traffic with Splunk Phantom?

sloshburch
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk Phantom to protect an EC2 group from malicious traffic?

Labels (1)
0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.


Compromised Amazon EC2 credentials can give a malicious actor access to currently running instances and configurations, and the ability to start new instances and services. Detect suspicious behavior early so you can react quickly and further investigate suspicious behavior.

Load data

How to implement: To run the Splunk Phantom EC2 Instance Isolation playbook, you need a Splunk Enterprise instance from which Phantom can draw data that ingests AWS and audit trail events.

Although there are several ways to get data into Phantom, this example uses the Phantom App for Splunk on Splunkbase. Verify that the playbook is configured to operate on splunk_events.

Before you run the playbook, verify that Splunk Phantom is receiving data from Splunk Enterprise. Also, verify your asset configurations on the Phantom Asset Configuration page, and that all assets are resolved on the Phantom Resolved Assets page.

Get insights

Isolate an EC2 instance by changing its security group in order to protect it from malicious traffic. You can start the EC2 Instance Isolation playbook alone or from another playbook.

To find the playbook, go to the Phantom main menu, select Playbooks, and search for ec2_instance_isolation.

How to respond: You can modify the Splunk Phantom EC2 Instance Isolation using several of the available Phantom apps to increase the scope of the actions you can take. For example, you can add actions based on the type of alert that was triggered using the Phantom AWS WAF or AWS IAM app.

Help

For more support, post a question to the Splunk Answers community.

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.


Compromised Amazon EC2 credentials can give a malicious actor access to currently running instances and configurations, and the ability to start new instances and services. Detect suspicious behavior early so you can react quickly and further investigate suspicious behavior.

Load data

How to implement: To run the Splunk Phantom EC2 Instance Isolation playbook, you need a Splunk Enterprise instance from which Phantom can draw data that ingests AWS and audit trail events.

Although there are several ways to get data into Phantom, this example uses the Phantom App for Splunk on Splunkbase. Verify that the playbook is configured to operate on splunk_events.

Before you run the playbook, verify that Splunk Phantom is receiving data from Splunk Enterprise. Also, verify your asset configurations on the Phantom Asset Configuration page, and that all assets are resolved on the Phantom Resolved Assets page.

Get insights

Isolate an EC2 instance by changing its security group in order to protect it from malicious traffic. You can start the EC2 Instance Isolation playbook alone or from another playbook.

To find the playbook, go to the Phantom main menu, select Playbooks, and search for ec2_instance_isolation.

How to respond: You can modify the Splunk Phantom EC2 Instance Isolation using several of the available Phantom apps to increase the scope of the actions you can take. For example, you can add actions based on the type of alert that was triggered using the Phantom AWS WAF or AWS IAM app.

Help

For more support, post a question to the Splunk Answers community.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...