IAM activity dashboard
Monitor your Amazon Web Services (AWS) user activity to uncover suspicious behaviors that might be associated with malicious activity, such as activity spikes or unusual events.
Use the IAM activity dashboard to monitor user activity in your environment, including the error events, which users have the most activity, activity over time, and the detailed list of error activities.
- From the menu bar, select Analytics and then Cloud security.
- Select IAM activity.
The IAM activity dashboard includes the following panels:
Panel | Source type | Datamodel |
---|---|---|
Error events | aws:cloudtrail
|
datamodel=Change.All_Changes
|
Activity by user | aws:cloudtrail
|
datamodel=Change.All_Changes
|
IAM actions | aws:cloudtrail
|
datamodel=Change.All_Changes
|
IAM actions over time | aws:cloudtrail
|
datamodel=Change.All_Changes
|
Success vs failure activity | aws:cloudtrail
|
datamodel=Change.All_Changes
|
Most recent IAM activity | aws:cloudtrail
|
datamodel:"Change.Account_Management"
|
IAM error activity | aws:cloudtrail
|
datamodel:"Change.Account_Management"
|
Filter your panel results
You can filter the results that you see in the dashboard panels.
Filter | Description |
---|---|
Account ID | Specify one or more of the data account IDs that you chose during onboarding. |
Regions | Specify one or more of the data source regions that you chose during onboarding. |
Status | Choose from the following statuses:
|
Action | Choose from the following actions:
|
Time range | Define the time range of a search with the time range picker. |
Security group dashboard | Network ACLs dashboard |
This documentation applies to the following versions of Splunk® Enterprise Security: 8.0.0
Feedback submitted, thanks!