Detection: Previously seen users in CloudTrail

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.

Removed in version: 5.2.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: fc0edc95-ff2b-48b0-9f6f-63da3789fd03 Author: Jason Brewer, Splunk Type: Baseline Product: Splunk Enterprise Security

Description

This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel

Search

1`cloudtrail` eventName=ConsoleLogin 
2| rename userIdentity.arn as user 
3| iplocation src 
4| eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) 
5| stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country 
6| outputlookup previously_seen_users_console_logins 
7| stats count

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
cloudtrail	`sourcetype=aws:cloudtrail`

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

Implementation

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in previously_seen_users_console_logins, which is a lookup file created as a result of running this support search.

Known False Positives

none

Associated Analytic Story

Suspicious AWS Login Activities

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1