rare_method_for_a_username.json

{
  "job_type": "anomaly_detector",
  "description": "Security: Cloudtrail - Looks for AWS API calls that, while not inherently suspicious or abnormal, are sourcing from a user context that does not normally call the method. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data.",
  "groups": [
    "security",
    "cloudtrail"
  ],
  "analysis_config": {
    "bucket_span": "60m",
    "detectors": [
      {
        "detector_description": "rare by \"event.action\" partition by \"user.name\"",
        "function": "rare",
        "by_field_name": "event.action",
        "partition_field_name": "user.name"
      }
    ],
    "influencers": [
      "user.name",
      "source.ip",
      "source.geo.city_name"
    ]
  },
  "allow_lazy_open": true,
  "analysis_limits": {
    "model_memory_limit": "128mb"
  },
  "data_description": {
    "time_field": "@timestamp"
  },
  "custom_settings": {
    "created_by": "ml-module-siem-cloudtrail"
  }
}