admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

pytest

Browse Source
This commit is contained in:
patel-bhavin
2022-06-27 16:18:00 -07:00
parent bb3a73b0dd
commit 047eafe9fa
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default_reference/analyticstories.conf
+3 -2
View File
@@ -15,7 +15,8 @@ explanation = Monitor for execution of reg.exe with parameters specifying an exp
how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]}
known_false_positives = None identified.
providing_technologies = []
providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
[savedsearch://ESCU - Detect new user AWS Console Login - Rule]
type = detection
@@ -25,7 +26,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
providing_technologies = []
providing_technologies = ["Amazon Web Services - Cloudtrail"]
### END DETECTIONS ###