User and Authentication Activity in
Monitor your Amazon Web Services (AWS) user activity to uncover suspicious behaviors that may be associated with malicious activity, such as activity spikes or unusual events.
Use the IAM Activity Dashboard
Use the IAM Activity Dashboard to monitor user activity in your environment, including the error events, which users have the most activity, activity over time, and the detailed list of error activities.
- From the menu bar, select Cloud Security.
- Click IAM Activity.
The IAM Activity Dashboard includes the following panels:
|Activity by User||
|IAM Actions Over Time||
|Success vs. Failure Activity||
|Most Recent IAM Activity||
|IAM Error Activity||
Filter your panel results
You can filter the results that you see in the dashboard panels.
|Account ID||Specify one or more of the data account IDs that you chose during onboarding.|
|Regions||Specify one or more of the data source regions that you chose during onboarding.|
|Status||Choose from the following statuses:
|Action||Choose from the following actions:
|Time Range||Define the time range of a search with the time range picker.|
Security Groups for your VPC in
Network ACL Analytics in
This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1, 7.0.2, 7.1.0, 7.1.1, 7.1.2, 7.2.0