previously_seen_cloud_provisioning_activity_sources___update.yml

name: Previously Seen Cloud Provisioning Activity Sources - Update
id: 9830abb9-be80-4563-b232-09bf1f628cf3
version: 3
creation_date: '2020-08-19'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: production
description: This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something.  It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached.
search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources'
how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider.
known_false_positives: No false positives have been identified at this time.
references: []
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
security_domain: network
schedule: Default Baseline