Skip to main content
Panther Knowledge Base

How do I correlate user activity across multiple alerts in Panther?

QUESTION

How do I correlate user activity across multiple alerts?

ANSWER

It's common for a single behavior to create multiple alerts within one or more log types. The steps below demonstrate correlating alerts in the Data Explorer from a single log type.

  1. While viewing an alert in the Panther Console, copy the username from either the event itself or the alert title (as shown below):Screen Shot 2022-10-14 at 2.25.42 PM.png
  2. Click View with Data Explorer to open a new page with the pre-populated query:
    SELECT *
    FROM panther_rule_matches.public.aws_cloudtrail t
    WHERE t.p_alert_id='78e5281811c0aalbf26306ea82caee65'
    AND (p_alert_ update_time between '2022-10-14 15:33:072' AND '2022-10-14 15:33:08Z')
    LIMIT 100
    • Keep track of the bolded fields above.
  3. Remove the Alert ID (WHERE ) clause
  4. Modify the timeframe to query events within several hours before the alert firing
  5. Add an (AND) clause for the username to correlate against
    SELECT *
    FROM panther_rule_matches.public.aws_cloudtrail
    WHERE p_event_time between '2022-10-14 12:33:00Z' AND '2022-10-14 15:33:08Z'
    AND userIdentity:arn = 'arn:aws:iam::111222333444:user/user_name'

The resultant logs can then be further filtered and summarized to investigate activity across all CloudTrail logs.

 

Additionally, the following SELECT statement can speed up analysis by presenting important CloudTrail-specific fields:

SELECT p_event_time, p_rule_id, p_rule_severity, eventName, eventSource, requestParameters, errorCode, userIdentity
FROM panther_rule_matches.public.aws_cloudtrail
WHERE (p_event_time between '2022-10-14 12:33:00Z' AND '2022-10-14 15:33:08Z')
AND userIdentity:arn = 'arn:aws:iam::111222333444:user/user_name'
ORDER BY p_event_time ASC

 

  • Was this article helpful?