The "Handle Suspicious AWS Console Logins" workflow template is designed to enhance security by automating the response to potentially malicious login attempts on AWS. It checks the source IP against VirusTotal, verifies user logins via Slack, and logs incidents in ServiceNow. If a login is deemed suspicious and unacknowledged, the workflow disables the user's access, ensuring swift remediation and protection of sensitive resources.
Trigger
Amazon SNS
Use Cases
Suspicious User Activity
Workflow Breakdown
Check Source IP of the Login in VirusTotal
Verify if the login was a root or user login, if root login log a ServiceNow incident
Find the user in Slack and ask to acknowledge login
If acknowledged, open and automatically resolve a ServiceNow Incident
If not acknowledged - disable the users login profile and access keys
Open a ServiceNow incident with the details of the event
Vendors
AWS, Slack, VirusTotal, ServiceNow