Splunk® Enterprise Security

Use Splunk Enterprise Security

IAM activity dashboard

Monitor your Amazon Web Services (AWS) user activity to uncover suspicious behaviors that might be associated with malicious activity, such as activity spikes or unusual events.

Use the IAM activity dashboard to monitor user activity in your environment, including the error events, which users have the most activity, activity over time, and the detailed list of error activities.

  1. From the menu bar, select Analytics and then Cloud security.
  2. Select IAM activity.

The IAM activity dashboard includes the following panels:

Panel Source type Datamodel
Error events aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Account_Management

Activity by user aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Account_Management

IAM actions aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Account_Management

IAM actions over time aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Account_Management

Success vs failure activity aws:cloudtrail datamodel=Change.All_Changes

nodename=All_Changes.Account_Management

Most recent IAM activity aws:cloudtrail datamodel:"Change.Account_Management"
IAM error activity aws:cloudtrail datamodel:"Change.Account_Management"


Filter your panel results

You can filter the results that you see in the dashboard panels.

Filter Description
Account ID Specify one or more of the data account IDs that you chose during onboarding.
Regions Specify one or more of the data source regions that you chose during onboarding.
Status Choose from the following statuses:
  • All - All event statuses, including both successes and errors.
  • Error - Only error event statuses. Some panels are based on error trends, so there is no difference in the results if you select All or if you select Error.
Action Choose from the following actions:
  • All - All event actions.
  • Each action - You can filter on each action individually or a combination of actions.
Time range Define the time range of a search with the time range picker.
Last modified on 12 September, 2024
Security group dashboard   Network ACLs dashboard

This documentation applies to the following versions of Splunk® Enterprise Security: 8.0.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters